ffdshow '.avi' File NULL Pointer Dereference Denial Of Service Vulnerability

Bugtraq ID:	42979
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Sep 03 2010 12:00AM
Updated:	Sep 03 2010 12:00AM
Credit:	Matthew Bergin
Vulnerable:	ffdshow ffdshow 1.1.3530.0
Not Vulnerable:

ffdshow '.avi' File NULL Pointer Dereference Denial Of Service Vulnerability

ffdshow is prone to a remote denial-of-service vulnerability caused by a NULL-pointer dereference.

An attacker can exploit this issue to cause the application to crash, denying service to legitimate users. Due to the nature of the issue, code execution may be possible; however, it has not been confirmed.

ffdshow 1.1.3530.0 is vulnerable; other versions may also be affected.

ffdshow '.avi' File NULL Pointer Dereference Denial Of Service Vulnerability

The following example '.avi' files are available to demonstrate this vulnerability. Symantec has not verified or tested the contents of the files; use caution when opening third-party files.

• /data/vulnerabilities/exploits/42979.zip

ffdshow '.avi' File NULL Pointer Dereference Denial Of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

ffdshow '.avi' File NULL Pointer Dereference Denial Of Service Vulnerability

References:

• ffdshow Homepage (ffdshow)