Actu
Vigil@nce - VLC: buffer overflow of ASF
April 2013 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can use an ASF video to generate a buffer overflow in
VLC, in order to trigger a denial of service, and possibly to
execute code.
– Impacted products: Unix (platform)
– Severity: 2/4
– Creation date: 15/04/2013
DESCRIPTION OF THE VULNERABILITY
The libasf_plugin module of VLC is used to play video documents in
ASF format.
This module uses the macro GETVALUE2b() to obtain values of ASF
fields. However, if the size of data is superior to the size of
the storage array, an overflow occurs.
An attacker can therefore use an ASF video to generate a buffer
overflow in VLC, in order to trigger a denial of service, and
possibly to execute code.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/VLC-buffer-overflow-of-ASF-12671
