VLC Media Player Subtitle 'StripTags()' Function Memory Corruption Vulnerability

Bugtraq ID:	46008
Class:	Boundary Condition Error
CVE:	CVE-2011-0522
Remote:	Yes
Local:	No
Published:	Jan 16 2011 12:00AM
Updated:	Nov 10 2014 12:57AM
Credit:	Harry Sintonen
Vulnerable:	VideoLAN VLC media player 1.1 VideoLAN VLC media player 1.1.1 Pardus Linux 2009 0 Gentoo Linux
Not Vulnerable:

VLC Media Player Subtitle 'StripTags()' Function Memory Corruption Vulnerability

VLC media player is prone to a heap-based memory-corruption vulnerability.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

VLC Media Player Subtitle 'StripTags()' Function Memory Corruption Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to open a malicious media file containing malicious subtitles with the vulnerable application.

The following proof-of-concept commands are available:

1. echo -ne '<foo\0crashme' | dd conv=notrunc bs=1 seek=877862 \ of=refined-australia-blu720p-sample.mkv

2. vlc --sub-language English refined-australia-blu720p-sample.mkv

VLC Media Player Subtitle 'StripTags()' Function Memory Corruption Vulnerability

Solution:
Updates are available. Please see the references for more information.

VLC Media Player Subtitle 'StripTags()' Function Memory Corruption Vulnerability

References:

• [vlc-devel] Security: Subtitle StripTags heap corruption (Harry Sintonen)
  
• GIT Commit (Harry Sintonen)
  
• VLC Homepage (VideoLAN)