PT-2008-1144 · Videolan · Vlc Media Player+1

Luigi Auriemma + 1 · Published 2008-01-16 · Updated 2017-09-29 · CVE-2008-0296

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VideoLAN VLC Media Player versions 0.8.6d and earlier

Description The issue is related to a heap-based buffer overflow in the libaccess realrtsp plugin. This might allow remote RTSP servers to cause a denial of service, such as an application crash, or potentially execute arbitrary code via a long string. The vulnerability can be exploited by a remote attacker, leading to either a denial of service or the execution of arbitrary code.

Recommendations For VideoLAN VLC Media Player versions 0.8.6d and earlier, consider updating to a newer version to mitigate the risk of exploitation. As a temporary workaround, restrict access to the libaccess realrtsp plugin to minimize the risk of exploitation. Avoid using the vulnerable plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2019-03965

CVE-2008-0296

DSA-1543-1

DTSA-111-1

Affected Products

Vlc Media Player

Libaccess Realrtsp

References · 20

• 🔥 https://exploit-db.com/exploits/5498 · Exploit
• 🔥 http://aluigi.altervista.org/adv/vlcxhof-adv.txt · Exploit
• https://osv.dev/vulnerability/CVE-2008-0296 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-0296 · Security Note
• https://debian.org/security/2008/dsa-1543 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-0296 · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=44892734 · Vendor Advisory
• http://debian.org/security/2008/dsa-1543 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-0296 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200803-13.xml · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-03965 · Security Note
• https://videolan.org/security/sa0801.html · Note
• https://securityfocus.com/bid/27221/solution · Note
• http://secunia.com/advisories/29284 · Note
• http://frsirt.com/english/advisories/2008/0105 · Note