VideoLAN has released a patch for their popular VLC Media player software to resolve a remote code execution vulnerability
The VLC open source media player is widely used in domestic and enterprise environments for playback of all kinds of video files and digital signage applications.
In a security bulletin, the developer state that:
If successful, a malicious third party could trigger either a crash of VLC or an arbitratry code execution with the privileges of the target user.
While these issues in themselves are most likely to just crash the player, we can’t exclude that they could be combined to leak user informations or remotely execute code. ASLR and DEP help reduce the likelyness of code execution, but may be bypassed.
In order to exploit the vulnerability (CVE-2020-13428), the user must be tricked into opening a specially crafted video file which would cause a buffer overflow in the H26x packetizer.
The problem is resolved in version 3.0.11 of the VLC media player.
VLC finds its way onto many systems because it is convenient to use and free to obtain and while it has a self-update facility this can be disabled by the user leaving the system vulnerable.
“We were very impressed with the service, I will say, the vulnerability found was one our previous organisation had not picked up, which does make you wonder if anything else was missed.”
Aim Ltd Chief Technology Officer (CTO)