PT-2009-4891 · Videolan · Vlc Media Player
Trancer
·
Publicado
2009-07-16
·
Atualizado
2017-09-19
·
CVE-2009-2484
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
VLC media player version 0.9.9
Description
A stack-based buffer overflow issue exists in the Win32AddConnection function, located in modules/access/smb.c, which can be triggered by a long smb URI in a playlist file. This can cause a denial of service, resulting in an application crash, and potentially allow the execution of arbitrary code. The issue is caused by a boundary error within the
Win32AddConnection() function and can be exploited by tricking a user into opening a malicious playlist file with an overly long "smb://" URI.Recommendations
For VLC media player version 0.9.9, consider disabling the
Win32AddConnection() function until a patch is available to prevent exploitation. Restrict access to opening playlist files from untrusted sources to minimize the risk of exploitation. Avoid using overly long "smb://" URIs in playlist files until the issue is resolved.Exploit
Correção
DoS
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Vlc Media Player