Code Execution Vulnerability Patched in Library Used by VLC, Other Media Players

guest · Oct 18, 2018

Code Execution Vulnerability Patched in Library Used by VLC, Other Media Players
The stack-based buffer overflow can be exploited remotely
October 18, 2018
https://news.softpedia.com/news/cod...-used-by-vlc-other-media-players-523314.shtml

The LIVE555 RTSP server library is used by media players such as VLC and MPlayer, as well as a number of embedded devices. Furthermore, the multimedia streaming libraries are used to develop client and server RTSP/RTCP/RTSP/SIP implementations.

"An exploitable code execution vulnerability exists in the HTTP packet-parsing functionality of the LIVE555 RTSP server library," says Cisco Talos' advisory. "A specially crafted packet can cause a stack-based buffer overflow, resulting in code execution. An attacker can send a packet to trigger this vulnerability."
VLC and MPlayer are some of the apps affected by the CVE-2018-4013 code execution vulnerability
The security bug can be exploited by attackers who send packets with multiple "Accept:" or "x-sessioncookie" strings designed to trigger a buffer overflow in the lookForHeader function which parses HTTP headers for tunneling RTSP over HTTP.

[...] was disclosed to the vendor on October 10 [...] Subsequently, Live Networks Inc patched the security issue on October 17, and the vulnerability was publicly disclosed one day later, on October 18.
Click to expand...

Log in or Sign up

Code Execution Vulnerability Patched in Library Used by VLC, Other Media Players

guest Guest

Log in or Sign up

Code Execution Vulnerability Patched in Library Used by VLC, Other Media Players

guest Guest

Useful Searches