ID CVE-2007-0017
Summary Multiple format string vulnerabilities in (1) the cdio_log_handler function in modules/access/cdda/access.c in the CDDA (libcdda_plugin) plugin, and the (2) cdio_log_handler and (3) vcd_log_handler functions in modules/access/vcdx/access.c in the VCDX (libvcdx_plugin) plugin, in VideoLAN VLC 0.7.0 through 0.8.6 allow user-assisted remote attackers to execute arbitrary code via format string specifiers in an invalid URI, as demonstrated by a udp://-- URI in an M3U file.
References
Vulnerable Configurations
  • VideoLAN VLC Media Player 0.7.0
    cpe:2.3:a:videolan:vlc_media_player:0.7.0
  • VideoLAN VLC Media Player 0.7.1
    cpe:2.3:a:videolan:vlc_media_player:0.7.1
  • VideoLAN VLC Media Player 0.7.2
    cpe:2.3:a:videolan:vlc_media_player:0.7.2
  • VideoLAN VLC Media Player 0.8.0
    cpe:2.3:a:videolan:vlc_media_player:0.8.0
  • VideoLAN VLC Media Player 0.8.1
    cpe:2.3:a:videolan:vlc_media_player:0.8.1
  • VideoLAN VLC Media Player 0.8.2
    cpe:2.3:a:videolan:vlc_media_player:0.8.2
  • VideoLAN VLC Media Player 0.8.4
    cpe:2.3:a:videolan:vlc_media_player:0.8.4
  • VideoLAN VLC Media Player 0.8.4a
    cpe:2.3:a:videolan:vlc_media_player:0.8.4a
  • VideoLAN VLC Media Player 0.8.5
    cpe:2.3:a:videolan:vlc_media_player:0.8.5
  • VideoLAN VLC Media Player 0.8.6
    cpe:2.3:a:videolan:vlc_media_player:0.8.6
CVSS
Base: 6.8 (as of 03-01-2007 - 08:21)
Impact:
Exploitability:
CWE CWE-134
CAPEC
  • Format String Injection
    An attacker includes formatting characters in a string input field on the target application. Most applications assume that users will provide static text and may respond unpredictably to the presence of formatting character. For example, in certain functions of the C programming languages such as printf, the formatting character %s will print the contents of a memory location expecting this location to identify a string and the formatting character %n prints the number of DWORD written in the memory. An attacker can use this to read or write to memory locations or files, or simply to manipulate the value of the resulting text in unexpected ways. Reading or writing memory may result in program crashes and writing memory could result in the execution of arbitrary code if the attacker can write to the program stack.
  • String Format Overflow in syslog()
    This attack targets the format string vulnerabilities in the syslog() function. An attacker would typically inject malicious input in the format string parameter of the syslog function. This is a common problem, and many public vulnerabilities and associated exploits have been posted.
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
nessus via4
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-1252.NASL
    description Kevin Finisterre discovered several format string problems in vlc, a multimedia player and streamer, that could lead to the execution of arbitrary code.
    last seen 2019-02-21
    modified 2018-07-20
    plugin id 24291
    published 2007-02-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=24291
    title Debian DSA-1252-1 : vlc - format string
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-200701-24.NASL
    description The remote host is affected by the vulnerability described in GLSA-200701-24 (VLC media player: Format string vulnerability) Kevin Finisterre has discovered that when handling media locations, various functions throughout VLC media player make improper use of format strings. Impact : An attacker could entice a user to open a specially crafted media location or M3U file with VLC media player, and execute arbitrary code on the system with the rights of the user running VLC media player. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-08-10
    plugin id 24309
    published 2007-02-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=24309
    title GLSA-200701-24 : VLC media player: Format string vulnerability
  • NASL family SuSE Local Security Checks
    NASL id SUSE_XINE-LIB-2505.NASL
    description This update fixes several format string bugs that can be exploited remotely with user-assistance to execute arbitrary code. (CVE-2007-0017)
    last seen 2019-02-21
    modified 2012-05-17
    plugin id 29600
    published 2007-12-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=29600
    title SuSE 10 Security Update : xine (ZYPP Patch Number 2505)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_XINE-LIB-2487.NASL
    description This update fixes several format string bugs that can be exploited remotely with user-assistance to execute arbitrary code. (CVE-2007-0017)
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 27487
    published 2007-10-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=27487
    title openSUSE 10 Security Update : xine-lib (xine-lib-2487)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_XINE-LIB-2488.NASL
    description This update fixes several format string bugs that can be exploited remotely with user-assistance to execute arbitrary code. (CVE-2007-0017)
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 27488
    published 2007-10-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=27488
    title openSUSE 10 Security Update : xine-lib (xine-lib-2488)
oval via4
accepted 2012-11-19T04:00:08.931-05:00
class vulnerability
contributors
  • name Shane Shaffer
    organization G2, Inc.
  • name Shane Shaffer
    organization G2, Inc.
definition_extensions
comment VLC media player is installed
oval oval:org.mitre.oval:def:11821
description Multiple format string vulnerabilities in (1) the cdio_log_handler function in modules/access/cdda/access.c in the CDDA (libcdda_plugin) plugin, and the (2) cdio_log_handler and (3) vcd_log_handler functions in modules/access/vcdx/access.c in the VCDX (libvcdx_plugin) plugin, in VideoLAN VLC 0.7.0 through 0.8.6 allow user-assisted remote attackers to execute arbitrary code via format string specifiers in an invalid URI, as demonstrated by a udp://-- URI in an M3U file.
family windows
id oval:org.mitre.oval:def:14313
status accepted
submitted 2012-01-24T15:20:33.178-04:00
title Multiple format string vulnerabilities in VideoLAN VLC 0.7.0 through 0.8.6
version 6
packetstorm via4
refmap via4
bid 21852
confirm
debian DSA-1252
gentoo GLSA-200701-24
misc
mlist [vlc-devel] 20070102 Security hole in VLC media player for Mac...
osvdb 31163
sectrack 1017464
secunia
  • 23592
  • 23829
  • 23910
  • 23971
suse SUSE-SA:2007:013
vupen ADV-2007-0026
xf vlcmediaplayer-udp-format-string(31226)
Last major update 27-01-2012 - 00:31
Published 02-01-2007 - 21:28
Last modified 10-10-2017 - 21:31
Back to Top