VLC Media Player 'swf 'file Stack Buffer Overflow Vulnerability

Release date: 2012-6 6
Updated on:

Affected Systems:
VideoLAN VLC Media Player 2.0.4
Description:
--------------------------------------------------------------------------------
Bugtraq id: 56861

VLC Media Player is a multimedia Player named VideoLAN client.

VLC media player 2.0.4 and other versions do not properly perform a boundary check when processing malicious files. By enticing victims to open specially crafted SWF files, remote attackers can exploit this vulnerability to cause buffer overflow, execute arbitrary code in the system or cause application crash.

<* Source: coolkaveh

Link: http://packetstormsecurity.org/files/118701/vlcmediaplayer204-overflow.txt
Http://xforce.iss.net/xforce/xfdb/80577
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

(7b4. a14): Access violation-code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
Eax = 75737574 ebx = 00e44c20 ecx = 7ffd5000 edx = 00e44e84 esi = 038488c8 edi = 000007c0
Eip = 75737574 esp = 0196fb5c ebp = 00000002 iopl = 0 nv up ei pl nz na pe nc
Cs = 001b ss = 0023 ds = 0023 es = 0023 fs = 003b gs = 0000 efl = 00210206
Missing image name, possible paged-out or Missing upt data.
75737574 ?? ???
0: 009>! Exploitable-v
Eax = 75737574 ebx = 00e44c20 ecx = 7ffd5000 edx = 00e44e84 esi = 038488c8 edi = 000007c0
Eip = 75737574 esp = 0196fb5c ebp = 00000002 iopl = 0 nv up ei pl nz na pe nc
Cs = 001b ss = 0023 ds = 0023 es = 0023 fs = 003b gs = 0000 efl = 00210206
75737574 ?? ???
How.achine \ HostUser
Executing Processor Architecture is x86
Debuggee is in User Mode
Debuggee is a live user mode debugging session on the local machine
Event Type: Exception
* ** ERROR: Symbol file cocould not be found. Defaulted to export
Symbols for ntdll. dll-
* ** ERROR: Symbol file cocould not be found. Defaulted to export
Symbols for C: \ Program Files \ VideoLAN \ VLC \ libvlccore. dll-
* ** ERROR: Symbol file cocould not be found. Defaulted to export
Symbols for C: \ Program
Files \ VideoLAN \ VLC \ plugins \ codec \ libavcodec_plugin.dll-
Exception Faulting Address: 0x75737574
First Chance Exception Type: STATUS_ACCESS_VIOLATION (0xC0000005)
Exception Sub-Type: Data Execution Protection (DEP) Violation

Exception Hash (Major/Minor): 0x307d391a. 0x6f0f1537

Stack Trace:
Unknown
Libvlccore! Vout_ReleasePicture + 0x32
Libavcodec_plugin! Vlc_entry_license _ 1_2_0l + 0xe09
Libavcodec_plugin! Vlc_entry_license _ 1_2_0l + 0xdf26b
Libavcodec_plugin! Vlc_entry_license _ 1_2_0l + 0xdee0e
Libavcodec_plugin! Vlc_entry_license _ 1_2_0l + 0xdf37b
Ntdll! RtlFreeHeap + 0x18b
Instruction Address: 0x0000000075737574

Description: Data Execution Prevention Violation
Short Description: DEPViolation
Exploitability Classification: EXPLOITABLE
Recommended Bug Title: Exploitable-Data Execution Prevention
Violation starting at Unknown Symbol @ 0x0000000075737574 called from
Libvlccore! Vout_ReleasePicture + 0x0000000000000032
(Hash = 0x307d391a. 0x6f0f1537)

User mode DEP access violations are exploitable.

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

VideoLAN
--------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.videolan.org/vlc/