VideoLAN (VLC) is "one of the most famous and used media players for various reasons: simple to use, open source, multi platform, many features available, continuosly updated and more". Two buffer overflow vulnerabilities have been discovered in VideoLAN, these allow attackers to overflow internal buffers in the product via a malicious subtitle file or via the product's web interface.
Vulnerable Systems:
* VideoLAN (VLC) version 0.8.6d and prior
Buffer-overflow in the handling of the subtitles
VLC is able to handle the subtitles automatically in a very simple way, it just checks the presence of ssa files with the same name of the loaded video and a possible subtitles folder. The functions which handle the MicroDvd, SSA and Vplayer subtitle formats are vulnerable to some stack based buffer-overflow vulnerabilities which can allow an attacker to execute malicious code.
Format string in the web interface
VLC can be controlled remotely through a nice web interface (a mini http server) which runs by default on port 8080. The instructions which handle the Connection parameter sent by the client pass its content to the httpd_MsgAdd function without the needed format argument.
In addition the new formatted Connection field is also sent back by the server in its reply, very useful for the attacker to tune the own exploit for increasing the percentage of success of the attack.
