CVE-2013-1868 : Détail

CVE-2013-1868

Overflow
50.66%V4
Network
2013-07-10
17h00 +00:00
2017-09-18
10h57 +00:00
CVE.org
NVD
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Gestion des notifications

Descriptions du CVE

Multiple buffer overflows in VideoLAN VLC media player 2.0.4 and earlier allow remote attackers to cause a denial of service (crash) and execute arbitrary code via vectors related to the (1) freetype renderer and (2) HTML subtitle parser.

Informations du CVE

Faiblesses connexes

CWE-ID Nom de la faiblesse Source
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Métriques

Métriques Score Gravité CVSS Vecteur Source
V2 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C nvd@nist.gov

EPSS

EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.

Score EPSS

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Percentile EPSS

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
EPSS First.org

Informations sur l'Exploit

Exploit Database EDB-ID : 23201

Date de publication : 2012-12-06 23h00 +00:00
Auteur : coolkaveh
EDB Vérifié : Yes

Title : VLC media player 2.0.4 buffer overflow POC Version : 2.0.4 Twoflower Date : 2012-12-06 Vendor : www.videolan.org/vlc/ Impact : Med/High Contact : coolkaveh [at] rocketmail.com Twitter : @coolkaveh tested : windows XP SP3 Author : coolkaveh ##################################################################################################################### VLC media player (also known as VLC) is a highly portable free and open-source media player and streaming media server written by the VideoLAN project. It is a cross-platform media player, with versions for Microsoft Windows, OS X, GNU/Linux, Android, BSD, Solaris, iOS, Syllable, BeOS, MorphOS, QNX and eComStation ##################################################################################################################### Bug : ---- buffer overflow during the handling of the swf file context-dependent Successful exploits can allow attackers to execute arbitrary code ---- ###################################################################################################################### (7b4.a14): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=75737574 ebx=00e44c20 ecx=7ffd5000 edx=00e44e84 esi=038488c8 edi=000007c0 eip=75737574 esp=0196fb5c ebp=00000002 iopl=0 nv up ei pl nz na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00210206 Missing image name, possible paged-out or corrupt data. 75737574 ?? ??? 0:009>!exploitable -v eax=75737574 ebx=00e44c20 ecx=7ffd5000 edx=00e44e84 esi=038488c8 edi=000007c0 eip=75737574 esp=0196fb5c ebp=00000002 iopl=0 nv up ei pl nz na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00210206 75737574 ?? ??? HostMachine\HostUser Executing Processor Architecture is x86 Debuggee is in User Mode Debuggee is a live user mode debugging session on the local machine Event Type: Exception *** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll - *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program Files\VideoLAN\VLC\libvlccore.dll - *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program Files\VideoLAN\VLC\plugins\codec\libavcodec_plugin.dll - Exception Faulting Address: 0x75737574 First Chance Exception Type: STATUS_ACCESS_VIOLATION (0xC0000005) Exception Sub-Type: Data Execution Protection (DEP) Violation Exception Hash (Major/Minor): 0x307d391a.0x6f0f1537 Stack Trace: Unknown libvlccore!vout_ReleasePicture+0x32 libavcodec_plugin!vlc_entry_license__1_2_0l+0xe09 libavcodec_plugin!vlc_entry_license__1_2_0l+0xdf26b libavcodec_plugin!vlc_entry_license__1_2_0l+0xdee0e libavcodec_plugin!vlc_entry_license__1_2_0l+0xdf37b ntdll!RtlFreeHeap+0x18b Instruction Address: 0x0000000075737574 Description: Data Execution Prevention Violation Short Description: DEPViolation Exploitability Classification: EXPLOITABLE Recommended Bug Title: Exploitable - Data Execution Prevention Violation starting at Unknown Symbol @ 0x0000000075737574 called from libvlccore!vout_ReleasePicture+0x0000000000000032 (Hash=0x307d391a.0x6f0f1537) User mode DEP access violations are exploitable. ################################################################################ Proof of concept included. http://www39.zippyshare.com/v/91522221/file.html Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23201.rar

Products Mentioned

Configuraton 0

Videolan>>Vlc_media_player >> Version To (including) 2.0.4

Videolan>>Vlc_media_player >> Version 2.0.0

Videolan>>Vlc_media_player >> Version 2.0.1

Videolan>>Vlc_media_player >> Version 2.0.2

Videolan>>Vlc_media_player >> Version 2.0.3

Références

http://secunia.com/advisories/59793
Tags : third-party-advisory, x_refsource_SECUNIA
http://marc.info/?l=oss-security&m=136367945627336&w=2
Tags : mailing-list, x_refsource_MLIST
http://www.securityfocus.com/bid/57079
Tags : vdb-entry, x_refsource_BID