CVE-2013-1868 : Detail

CVE-2013-1868

Overflow
20.21%V3
Network
2013-07-10
17h00 +00:00
2017-09-18
10h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Multiple buffer overflows in VideoLAN VLC media player 2.0.4 and earlier allow remote attackers to cause a denial of service (crash) and execute arbitrary code via vectors related to the (1) freetype renderer and (2) HTML subtitle parser.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Metrics

Metrics Score Severity CVSS Vector Source
V2 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 23201

Publication date : 2012-12-06 23h00 +00:00
Author : coolkaveh
EDB Verified : Yes

Title : VLC media player 2.0.4 buffer overflow POC Version : 2.0.4 Twoflower Date : 2012-12-06 Vendor : www.videolan.org/vlc/ Impact : Med/High Contact : coolkaveh [at] rocketmail.com Twitter : @coolkaveh tested : windows XP SP3 Author : coolkaveh ##################################################################################################################### VLC media player (also known as VLC) is a highly portable free and open-source media player and streaming media server written by the VideoLAN project. It is a cross-platform media player, with versions for Microsoft Windows, OS X, GNU/Linux, Android, BSD, Solaris, iOS, Syllable, BeOS, MorphOS, QNX and eComStation ##################################################################################################################### Bug : ---- buffer overflow during the handling of the swf file context-dependent Successful exploits can allow attackers to execute arbitrary code ---- ###################################################################################################################### (7b4.a14): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=75737574 ebx=00e44c20 ecx=7ffd5000 edx=00e44e84 esi=038488c8 edi=000007c0 eip=75737574 esp=0196fb5c ebp=00000002 iopl=0 nv up ei pl nz na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00210206 Missing image name, possible paged-out or corrupt data. 75737574 ?? ??? 0:009>!exploitable -v eax=75737574 ebx=00e44c20 ecx=7ffd5000 edx=00e44e84 esi=038488c8 edi=000007c0 eip=75737574 esp=0196fb5c ebp=00000002 iopl=0 nv up ei pl nz na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00210206 75737574 ?? ??? HostMachine\HostUser Executing Processor Architecture is x86 Debuggee is in User Mode Debuggee is a live user mode debugging session on the local machine Event Type: Exception *** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll - *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program Files\VideoLAN\VLC\libvlccore.dll - *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program Files\VideoLAN\VLC\plugins\codec\libavcodec_plugin.dll - Exception Faulting Address: 0x75737574 First Chance Exception Type: STATUS_ACCESS_VIOLATION (0xC0000005) Exception Sub-Type: Data Execution Protection (DEP) Violation Exception Hash (Major/Minor): 0x307d391a.0x6f0f1537 Stack Trace: Unknown libvlccore!vout_ReleasePicture+0x32 libavcodec_plugin!vlc_entry_license__1_2_0l+0xe09 libavcodec_plugin!vlc_entry_license__1_2_0l+0xdf26b libavcodec_plugin!vlc_entry_license__1_2_0l+0xdee0e libavcodec_plugin!vlc_entry_license__1_2_0l+0xdf37b ntdll!RtlFreeHeap+0x18b Instruction Address: 0x0000000075737574 Description: Data Execution Prevention Violation Short Description: DEPViolation Exploitability Classification: EXPLOITABLE Recommended Bug Title: Exploitable - Data Execution Prevention Violation starting at Unknown Symbol @ 0x0000000075737574 called from libvlccore!vout_ReleasePicture+0x0000000000000032 (Hash=0x307d391a.0x6f0f1537) User mode DEP access violations are exploitable. ################################################################################ Proof of concept included. http://www39.zippyshare.com/v/91522221/file.html Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23201.rar

Products Mentioned

Configuraton 0

Videolan>>Vlc_media_player >> Version To (including) 2.0.4

Videolan>>Vlc_media_player >> Version 2.0.0

Videolan>>Vlc_media_player >> Version 2.0.1

Videolan>>Vlc_media_player >> Version 2.0.2

Videolan>>Vlc_media_player >> Version 2.0.3

References

http://secunia.com/advisories/59793
Tags : third-party-advisory, x_refsource_SECUNIA
http://marc.info/?l=oss-security&m=136367945627336&w=2
Tags : mailing-list, x_refsource_MLIST
http://www.securityfocus.com/bid/57079
Tags : vdb-entry, x_refsource_BID