Summary : Format string injection in Vorbis, Theora, SAP and CDDA plugins Date : 12 June 2007 Affected versions : VLC media player 0.8.6b and earlier ID : VideoLAN-SA-0702 CVE reference : CVE-2007-3316
VLC media player Ogg/Vorbis, Ogg/Theora, CDDA (CD Digital Audio) and SAP (Service Announce Protocol) plugins are prone to a C-style format string vulnerability when trying to parse a media data stream.
Valid but carefully crafted .ogg (Vorbis) or .ogm (Theora) files, CDDB entries or SAP/SDP messages can trigger the bug. We therefore consider this bug to have a high severity.
If successful, a malicious third party could use this vulnerability to execute arbitrary code within the context of VLC media player (i.e. acquire local user privileges on the vulnerable system), or crash the player instance.
Exploitation of this bug requires getting VLC to read a crafted Ogg file, an Audio CD with a crafted CDDB entry. If SAP service discovery is enabled, the bug can be exploited by sending a crafted multicast packets on the network.
If support for Audio CDs and ogg files are not used,
one can remove the affected plugins manually from the VLC plugin
Relevant filenames are as follow:
access/libcdda_plugin.so(typically found in
Otherwise, files coming from untrusted source should not be opened, and CDDB must be disabled.
The SAP service discovery plugin must not enabled (it is disabled by default).
VLC media player 0.8.6c addresses this issue and introduces further usability fixes.
Pre-compiled packages for Mac OS X and MS Windows should be shortly available at the usual download locations.
Linux and BSD users should get relevant software upgrades from their respective distribution/OS vendor.
This bug responsibly reported by David Thiel from iSEC Partners Inc, originally for the Ogg/Vorbis plugin, and was found to affect other plugins after further internal analysis.