Slashdot Mirror
VLC And Secunia Fighting Over Vulnerability Reports
benjymouse writes "Following a blog post by security company Secunia, VideoLAN (vendor of popular VLC media player) president Jean-Baptiste Kempf accuses Secunia of lying in a blog post titled 'More lies from Secunia.' It seems that Secunia and Jean-Baptiste Kempf have different views on whether a vulnerability has been patched. At one point VLC threatened legal action unless Secunia updated their SA51464 security advisory to show the issue as patched. While Secunia changed the status pending their own investigation, they later reverted to 'unpatched.' Secunia claimed that they had PoC illustrating that the root issue still existed and 3rd party confirmation (an independent security researcher found the same issue and reported it to Secunia)."
There are two bugs: one is a vulnerability in ffmpeg's swf parser that vlc worked around since they don't support swf. The VLC developers think Secunia should have reported the bug to ffmpeg, which seems pretty sensible. The other bug is an uncaught exception in the Matroska demuxer with overly large chunks that merely results in std::terminate being called; the Matroska demux maintainer apologized, but, despite dire warnings from Secunia that it could be exploitable, it most certainly is not.
despite dire warnings from Secunia that it could be exploitable, it most certainly is not.
That depends entirely on what "exploit" means. If VLC is a core part of a media service, calling anything named "terminate" sounds like a recipe for a simple DoS. I don't think VLC is overpriced enough to serve in any critical roles (like, perhaps, a giant Times Square display), but it could easily be the magic under a layer of consultants' bills.
The easy assumption is that any time a program does something that wouldn't be expected, it's exploitable to cause some kind of annoyance. Whether that alone is enough to warrant a fix is a different matter.
You do not have a moral or legal right to do absolutely anything you want.
when I need to call std::terminate.
Silence is a state of mime.
"Kaveh Ghaemmaghami has discovered a vulnerability in VLC Media Player, which can be exploited by malicious people to potentially compromise a user's system."
"The vulnerability is caused due to a use-after-free error when releasing a picture object during decoding of video files. This can be exploited to reference an object's callback function pointer from already freed memory. Successful exploitation may allow execution of arbitrary code."
Well if it can be exploited to execute arbitrary code, why not exploit it to execute arbitrary code? Or shut up and stop talking garbage ("to reference an object's callback function pointer" What?? Is that supposed to sound technical while being gibberish?).
Put up or shut up and the argument becomes more regular and concrete like most exploits.
i.e. proof of concept, the thing that seems to be missing from Secunia's claim.
Exceptions aren't exploitable, it's the buffer overflow that lets you write onto the exception chain that is exploitable.
I have read this quite concerned but am now finally relieved that my porn viewing will not be affected in the slightest.
Thank you for reporting on "stuff the matters".
A 'singular oddity' is an event that cannot be explained and only happens when you are alone.
Learn.
It doesn't. C++ exceptions have exactly NOTHING to do with Win32 structured exceptions.
I tried accessing the VLC website, but all I got was an error message:
Please wait while your font cache is rebuilt. This should take less than a few minutes.
Threatens 'legal action'? What's up with that?
“He’s not deformed, he’s just drunk!”
No citation needed. AFAIK, there are no known vectors for exploiting an uncaught exception, with two exceptions:
Check out my sci-fi/humor trilogy at PatriotsBooks.
They have always been correct.
(original submitter here)
If Secunia is correct that the root cause is a use-after-free vulnerability, it exploitability is likely not limited to simple DOS. Secunia talk about a callback handler. A use after free vulnerability can easily lead to execution of arbitrary code, depending on how much control the artacker can assert over the memory.
Also, it is interesting if the sentiment is that it is not a vulnerability if it sits in a linked library. Should it really be considered a vulnerability of the library and not of the product using the library? For all intents and purposes, it is a vulnerability of the product.
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
He even brought out the cheese for the pasta when he mentioned Windows 8, you need to give him at least 3 out of 5. I almost fed him myself...
uhm...
From a journalistic standpoint, that last sentance DOES need a citation. It stands out even worse because the other statements are well cited.
THL phish sticks
Should it really be considered a vulnerability of the library and not of the product using the library? For all intents and purposes, it is a vulnerability of the product.
Why? We don't report vulnerabilities in the GNU C library (glibc) as being vulnerabilities of every program that has links to it. Even Secunia reports vulnerabilities in glibc as vulnerabilities of the library, not the individual programs using it. [cite: https://secunia.com/advisories/search/]
You can argue that it ought to be the other way, but at the very least Secunia should be consistent with their own practice. Flagging VLC because of a vulnerability in ffmpeg is not consistent with Secunia's own past practice.
If I update the library it resolves the problem for all users of the library. Therefore, the problem is in the shared library, not in the users of that library.
It may be possible to trigger the bug in users of the library, but the actual error (and the thing that must be fixed) is in the library, not the program using it.
What if the library is statically linked (as it is on some platforms with VLC as I understand it)? Then it is distributed with the product.
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
If that's what's happening, then yes, that sort of bug is almost always exploitable.
Check out my sci-fi/humor trilogy at PatriotsBooks.
My understanding is the libmkv terminate was the DoS portion. The SWF use-after-free would indeed be vulnerable, but is also within ffmpeg. While it would be nice - and in their best interests - if VLC fixed it upstream, it should have been reported as an ffmpeg issue imo.
For the last time, PIN Number and ATM Machine are redundancies!
Not to mention as a guy that gives VLC out to Joe and Jane average I can tell ya VLC is used for local content on a local computer which as you said is all controlled by the one running the video, despite the LAN part of the title nobody I've seen have ever used it for anything but local content. Also I'm at work so can't check ATM but doesn't VLC run in lower rights than the user? i know I've never seen a UAC prompt to use VLC and it has to pop up a UAC to check for updates so if its running in low or limited permissions the best they can do is crash the player.
In any case i can say i honestly don't care what Securina says, VLC has been one of the most problem free players i have ever encountered in the many many years I've been working in retail, VLC and KLite are my to "go to" when it comes to media on a new install and if the VLC guys say its bullshit I'll give them the benefit of the doubt simply because of how damned solid they have made their player. i have put in content with funky obscure codecs that hasn't been supported by anybody in ages, VLC fired right up and played it without a glitch nor a skip, that means a lot in my position.
So if any of the VLC devs are reading this there is at least one shop owner that will trust you if you say its bogus, your player has been so solid i even keep it on my service call thumbdrive so its always there if I need it. Great job guys, truly excellent work.
ACs don't waste your time replying, your posts are never seen by me.
Then who you are going to call?
Well I'm not a security expert so I can't comment on that, but what I DO have is a shitload of PCs at the shop and I can say that the VLC guy is right, I just tested the Securina "Proof Of Concept" SWF and it don't do shit under VLC. If any Securina fans are here it shows an image, the QT logo, and that's it.
I tried it on 32bit and 64bit win 7 and even the old XP box in the corner and he's right, first of all VLC won't even open it by default, won't show up in either open with nor any right click menus for that format, so you have to fire up VLC and THEN switch away from media files to all files to even see the thing in VLC and as I said when run? Nothing, hell it didn't even make VLC hang or crash.
So I'm sorry Securina but if that is your "proof" I gotta throw a flag, bullshit on the field. I haven't got any real old versions of VLC to check what it does on old versions but since VLC has had an updater in place for a couple of years now I can say that I just don't run into anybody running old versions of VLC in the wild so i don't consider that a test worth running.
ACs don't waste your time replying, your posts are never seen by me.
Ironically, the incentives you flag are the very reason it may continue.
With that said, the exception is not the security hole; the integer overflow is.
Check out my sci-fi/humor trilogy at PatriotsBooks.
Maybe it doesn't work with DEP or ALSR, did you disable them?
If you ignore ACs because they are anonymous - you're an idiot.
It doesn't run at lower rights than the user, it runs at the same rights as the user. When it needs more rights, that's why you see the UAC prompt.
If you ignore ACs because they are anonymous - you're an idiot.
I figured the old XP box would cover that, its a socket 754 Sempron so there isn't any DEP or ALSR and again, nothing. I also tried it on a 32Bit Conroe Celeron and after reading your post switched off DEP and ASLR and again,nothing.
Again maybe it did something on some old version which I would consider valid...if it didn't have an updater, but it does and since it updates itself and is free I don't really consider what it did in some old version a valid test. after all if they have no Internet so it can't update the odds they are gonna run into a SWF malware file is pretty much non existent,it'd be like saying a PC that is airgapped is in danger of viruses. This is why i don't bother with tests for malware that require Windows to never be updated because the only ones I see running around with WU turned off are the pirates and if they are smart enough to pirate Windows they ought to be smart enough to update the damned thing without getting bit by WGA.
As for the AC that wet his panties over how I wrote Secunia? I thought it was Securina, as in Security? Certainly makes more damned sense than what its really called, WTF is a Secunia anyway? If they are just gonna pick a name out of a hat I vote for Petunia, there really ain't enough Petunias in the world.
ACs don't waste your time replying, your posts are never seen by me.
But users are run in limited (but not low,which is even more restricted) mode unless they agree to an elevated through a prompt so again I don't see this as a problem, and of the boxes at the shop I tried it on both an old Sempron XP box without DEP or ASLR, a Win 7 32bit Conroe Celeron with both ASLR and DEP on and off, and finally my 64bit home box with ASLR and DEP on...nothing. Their PoC didn't do squat, no crashes, no hangs, nothing.
So unless they can bring something better than a PoC that I can't get to do shit I'm gonna have to side with the VLC guys. I mean on ALL the systems i tried except for my 64bit home system they don't even have AV installed yet so if it was gonna do anything at all? i gave it the perfect platform.
ACs don't waste your time replying, your posts are never seen by me.
Rarely understood, often vilified. Satire is the most dangerous form of literature.
It was a silly joke about the corruption of language, how the vernacular becomes the standard and the frequent error of those who jump on others supposed mistake.
Y'all get a nice big WOOOOSH!
Cwm, fjord-bank glyphs vext quiz