VLC Media Player MKV File Parsing Remote Code Execution Vulnerability

Bugtraq ID:	46060
Class:	Unknown
CVE:	CVE-2011-0531
Remote:	Yes
Local:	No
Published:	Jan 30 2011 12:00AM
Updated:	Nov 10 2014 12:57AM
Credit:	Dan Rosenberg
Vulnerable:	VideoLAN VLC media player 1.1.6 1 VideoLAN VLC media player 1.1.4 VideoLAN VLC media player 1.1.3 VideoLAN VLC media player 1.1.2 VideoLAN VLC media player 1.1.1 VideoLAN VLC media player 1.1 VideoLAN VLC media player 1.0.6 VideoLAN VLC media player 1.0.5 VideoLAN VLC media player 1.0.3 VideoLAN VLC media player 1.0.2 VideoLAN VLC media player 1.0.1 VideoLAN VLC media player 1.0 VideoLAN VLC media player 1.1.6 VideoLAN VLC media player 1.1.5 VideoLAN VLC media player 1.0.4 Pardus Linux 2009 0 Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0
Not Vulnerable:	VideoLAN VLC media player 1.1.7

VLC Media Player MKV File Parsing Remote Code Execution Vulnerability

VLC Media Player is prone to a remote code-execution vulnerability.

Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts may result in a denial-of-service condition.

This issue affects VLC Media Player versions 1.1.6.1 and prior.

VLC Media Player MKV File Parsing Remote Code Execution Vulnerability

The following exploit is available:

• /data/vulnerabilities/exploits/46060.rb

VLC Media Player MKV File Parsing Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references for more information.

VLC Media Player MKV File Parsing Remote Code Execution Vulnerability

References:

• Security Advisory 1102 (VideoLAN)
  
• VLC Homepage (VideoLAN)