Stories
Slash Boxes
Comments

SoylentNews is people

Flaws Allow Hacking a System Playing Untrusted Videos on VLC Player

posted by martyb on Tuesday June 25 2019, @11:08PM   Printer-friendly
from the no-more-playing-around dept.

MrPlow writes:

Submitted via IRC for SoyCow1944

An attacker could remotely take full control over a computer system while playing untrusted videos with any version of VLC media player software prior to 3.0.7.

The hack is possible due to two high-risk security flaws (CVE-2019-5439, CVE-2019-12874) that could potentially lead to arbitrary code execution attacks. The company Videolan also addressed many other medium and low-severity security vulnerabilities in its software.

"A remote user can create some specially crafted avi or mkv files that, when loaded by the target user, will trigger a heap buffer overflow (read) in ReadFrame (demux/avi/avi.c), or a double free in zlib_decompress_extra() (demux/mkv/utils.cpp) respectively" reads the security advisory published by the company. "If successful, a malicious third party could trigger either a crash of VLC or an arbitratry code execution with the privileges of the target user."

Source: https://securityaffairs.co/wordpress/87433/breaking-news/vlc-player-flaws.html

Original Submission

 
This discussion has been archived. No new comments can be posted.
Flaws Allow Hacking a System Playing Untrusted Videos on VLC Player | Log In/Create an Account | Top | 17 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 2) by MostCynical on Tuesday June 25 2019, @11:31PM (4 children)

    by MostCynical (2589) on Tuesday June 25 2019, @11:31PM (#859915) Journal

    "with the privileges of the target user."

    Don't run as admin.
    Sudo is your friend.

    --
    "I guess once you start doubting, there's no end to it." -Batou, Ghost in the Shell: Stand Alone Complex
    Starting Score:    1  point
    Karma-Bonus Modifier   +1  
    Total Score:   2  

  • (Score: 3, Funny) by RamiK on Wednesday June 26 2019, @12:21AM (2 children)

    by RamiK (1813) on Wednesday June 26 2019, @12:21AM (#859934)

    $ sudo vlc ./porn_S05E03.mkv

    --
    compiling...

    • (Score: 3, Funny) by looorg on Wednesday June 26 2019, @01:35AM (1 child)

      by looorg (578) on Wednesday June 26 2019, @01:35AM (#859952)

      Since I missed the first four seasons and change, what the fuck did I miss?

      • (Score: 2) by http on Wednesday June 26 2019, @06:20AM

        by http (1920) on Wednesday June 26 2019, @06:20AM (#860008)

        Fucking.

        --
        I browse at -1 when I have mod points. It's unsettling.

  • (Score: 0) by Anonymous Coward on Thursday June 27 2019, @03:14AM

    by Anonymous Coward on Thursday June 27 2019, @03:14AM (#860370)
    But your ssh keys, emails, etc aren't stored as admin either right?

    Run vlc to view random videos using a "vlc-unsafe" user account. Use a wrapper script/alias to make it easier if you want.

    Similarly use firefox-unsafe to browse SN etc using , firefox-bank1 for bank #1 and so on.