Cloud security course specialists reported the finding of at least three critical vulnerabilities in VLC Media Player, the open source media player and framework developed by VideoLAN. Successful exploitation of these flaws would lead to scenarios such as buffer overflow and out-of-bounds reading.
Below are brief overviews of reported errors, in addition to their respective tracking keys and scores according to the Common Vulnerability Scoring System (CVSS).
CVE-2020-9308: This vulnerability exists due to a limit error when processing RAR5 files in archive_read_support_format_rar5.c in libarchive, which would allow threat actors to execute arbitrary code on the target system. A remote attacker can create a specially designed RAR5 file, tricking the victim into opening it, triggering memory corruption, which could result in a total compromise of the vulnerable system.
The flaw received a score of 7.7/10, so it is considered a high-gravity error. The vulnerability can be exploited remotely, although the existence of malware to trigger the attack is unknown, cloud security course experts mention.
CVE-2019-19221: This flaw exists due to a limit condition of “archive_wstring_append_from_mbs” in “archive_string.c”, which in turn is due to an incorrect “mbrtowc” or “mbtowc” call, which would allow hackers to access sensitive information.
A remote threat actor can create a specially crafted storage file, trick the victim into opening it, trigger an out-of-bounds read error, and read the contents of the memory into the system. This flaw received a score of 4.7/10 on the CVSS scale, making it a medium severity vulnerability.
This flaw could also be exploited remotely by an unauthenticated hacker over the Internet, although there appears to be no malware related to this potential attack, cloud security course experts mention.
CVE-2020-13428: This vulnerability exists due to a limit error in the hxxx_AnnexB_to_xVCfunction() in modules/packetizer/hxxx_nal.c in VideoLAN VLC when processing H.264 Annx-B video files. A remote attacker can create a specially designed .avi file, trick the victim into opening it, trigger heap-based buffer overflow, and execute arbitrary code on the target system.
The flaw received a score of 7.7/10, so it is considered a critical vulnerability. As in previous cases, this vulnerability could be exploited remotely, although there is no exploit to complete the attack.
Developers have already released the corresponding updates, so users of affected deployments should only verify the correct installation of the security patches. For further reports on vulnerabilities, exploits, malware variants and computer security risks, it is recommended to enter the website of the International Institute of Cyber Security (IICS), as well as the official platforms of technology companies.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
