Vulnerabilities > CVE-2011-2194 - Numeric Errors vulnerability in Videolan VLC Media Player

#
# (C) Tenable Network Security, Inc.
#


include("compat.inc");


if (description)
{
  script_id(55024);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/07/09");

  script_cve_id("CVE-2011-1931", "CVE-2011-2194");
  script_bugtraq_id(47602, 48171);

  script_xref(name:"EDB-ID", value:"17372");
  script_xref(name:"Secunia", value:"44412");

  script_name(english:"VLC < 1.1.10 Multiple Vulnerabilities");

   script_set_attribute(attribute:"synopsis", value:
"The remote Windows host contains a media player that is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of VLC media player installed on the remote Windows host is prior to 1.1.10. It is, therefore, 
affected by multiple vulnerabilities:

  - A denial of service (DoS) vulnerability exists in VideoLAN VLC media player before 1.1.10. 
    An unauthenticated remote attacker can exploit this issue, via a malformed AMV file, to cause a denial of 
    service (memory corruption) or possibly execute arbitrary code. (CVE-2011-1931).

  - A denial of service (DoS) vulnerability exists in VideoLAN VLC media player before 1.1.10 due to integer 
    overflow in XSPF playlist parser. An unauthenticated remote attacker can exploit this issue, via 
    unspecified vectors that trigger a heap-based buffer overflow to cause a denial of service 
    (memory corruption) or possibly execute arbitrary code. (CVE-2011-2194).

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://cxsecurity.com/issue/WLB-2011070117");
  script_set_attribute(attribute:"see_also", value:"https://www.videolan.org/security/sa1104.html");
  script_set_attribute(attribute:"solution", value:"Upgrade to VLC version 1.1.10 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2011-2194");

  script_set_attribute(attribute:"vuln_publication_date", value:"2011/06/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2011/06/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2011/06/09");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:videolan:vlc_media_player");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2011-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("vlc_installed.nasl", "macosx_vlc_installed.nbin");

  exit(0);
}

include('vcf.inc');

os = get_kb_item('Host/MacOSX/Version');

if (!isnull(os))
    app = 'VLC';
else
    app = 'VLC media player';

app_info = vcf::get_app_info(app:app);
constraints = [{'fixed_version':'1.1.10'}];
vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Gentoo Linux Security Advisory GLSA 201411-01.
#
# The advisory text is Copyright (C) 2001-2016 Gentoo Foundation, Inc.
# and licensed under the Creative Commons - Attribution / Share Alike 
# license. See http://creativecommons.org/licenses/by-sa/3.0/
#

include("compat.inc");

if (description)
{
  script_id(78879);
  script_version("$Revision: 1.4 $");
  script_cvs_date("$Date: 2016/05/20 14:03:00 $");

  script_cve_id("CVE-2010-1441", "CVE-2010-1442", "CVE-2010-1443", "CVE-2010-1444", "CVE-2010-1445", "CVE-2010-2062", "CVE-2010-2937", "CVE-2010-3124", "CVE-2010-3275", "CVE-2010-3276", "CVE-2010-3907", "CVE-2011-0021", "CVE-2011-0522", "CVE-2011-0531", "CVE-2011-1087", "CVE-2011-1684", "CVE-2011-2194", "CVE-2011-2587", "CVE-2011-2588", "CVE-2011-3623", "CVE-2012-0023", "CVE-2012-1775", "CVE-2012-1776", "CVE-2012-2396", "CVE-2012-3377", "CVE-2012-5470", "CVE-2012-5855", "CVE-2013-1868", "CVE-2013-1954", "CVE-2013-3245", "CVE-2013-4388", "CVE-2013-6283", "CVE-2013-6934");
  script_bugtraq_id(42386, 45632, 45927, 46008, 46060, 47012, 47293, 48171, 48664, 51231, 52550, 53391, 53535, 54345, 55850, 57079, 57333, 61032, 61844, 62724, 65139);
  script_xref(name:"GLSA", value:"201411-01");

  script_name(english:"GLSA-201411-01 : VLC: Multiple vulnerabilities");
  script_summary(english:"Checks for updated package(s) in /var/db/pkg");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Gentoo host is missing one or more security-related
patches."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The remote host is affected by the vulnerability described in GLSA-201411-01
(VLC: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in VLC. Please review the
      CVE identifiers referenced below for details.
  
Impact :

    A remote attacker could entice a user to open a specially crafted media
      file using VLC, possibly resulting in execution of arbitrary code with
      the privileges of the process or a Denial of Service condition.
  
Workaround :

    There is no known workaround at this time."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security.gentoo.org/glsa/201411-01"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"All VLC users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=media-video/vlc-2.1.2'"
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'VLC MMS Stream Handling Buffer Overflow');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:'White_Phosphorus');

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:vlc");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2014/11/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/11/06");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2014-2016 Tenable Network Security, Inc.");
  script_family(english:"Gentoo Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("qpkg.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (qpkg_check(package:"media-video/vlc", unaffected:make_list("ge 2.1.2"), vulnerable:make_list("lt 2.1.2"))) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = qpkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "VLC");
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Debian Security Advisory DSA-2257. The text 
# itself is copyright (C) Software in the Public Interest, Inc.
#

include("compat.inc");

if (description)
{
  script_id(55045);
  script_version("1.10");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");

  script_cve_id("CVE-2011-2194");
  script_xref(name:"DSA", value:"2257");

  script_name(english:"Debian DSA-2257-1 : vlc - heap-based buffer overflow");
  script_summary(english:"Checks dpkg output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Debian host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Rocco Calvi discovered that the XSPF playlist parser of VLC, a
multimedia player and streamer, is prone to an integer overflow
resulting in a heap-based buffer overflow. This might allow an
attacker to execute arbitrary code by tricking a victim into opening a
specially crafted file.

The oldstable distribution (lenny) is not affected by this problem."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://packages.debian.org/source/squeeze/vlc"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.debian.org/security/2011/dsa-2257"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"Upgrade the vlc packages.

For the stable distribution (squeeze), this problem has been fixed in
version 1.1.3-1squeeze6."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:vlc");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:6.0");

  script_set_attribute(attribute:"patch_publication_date", value:"2011/06/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2011/06/10");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2011-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Debian Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("debian_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (deb_check(release:"6.0", prefix:"libvlc-dev", reference:"1.1.3-1squeeze6")) flag++;
if (deb_check(release:"6.0", prefix:"libvlc5", reference:"1.1.3-1squeeze6")) flag++;
if (deb_check(release:"6.0", prefix:"libvlccore-dev", reference:"1.1.3-1squeeze6")) flag++;
if (deb_check(release:"6.0", prefix:"libvlccore4", reference:"1.1.3-1squeeze6")) flag++;
if (deb_check(release:"6.0", prefix:"mozilla-plugin-vlc", reference:"1.1.3-1squeeze6")) flag++;
if (deb_check(release:"6.0", prefix:"vlc", reference:"1.1.3-1squeeze6")) flag++;
if (deb_check(release:"6.0", prefix:"vlc-data", reference:"1.1.3-1squeeze6")) flag++;
if (deb_check(release:"6.0", prefix:"vlc-dbg", reference:"1.1.3-1squeeze6")) flag++;
if (deb_check(release:"6.0", prefix:"vlc-nox", reference:"1.1.3-1squeeze6")) flag++;
if (deb_check(release:"6.0", prefix:"vlc-plugin-fluidsynth", reference:"1.1.3-1squeeze6")) flag++;
if (deb_check(release:"6.0", prefix:"vlc-plugin-ggi", reference:"1.1.3-1squeeze6")) flag++;
if (deb_check(release:"6.0", prefix:"vlc-plugin-jack", reference:"1.1.3-1squeeze6")) flag++;
if (deb_check(release:"6.0", prefix:"vlc-plugin-notify", reference:"1.1.3-1squeeze6")) flag++;
if (deb_check(release:"6.0", prefix:"vlc-plugin-pulse", reference:"1.1.3-1squeeze6")) flag++;
if (deb_check(release:"6.0", prefix:"vlc-plugin-sdl", reference:"1.1.3-1squeeze6")) flag++;
if (deb_check(release:"6.0", prefix:"vlc-plugin-svg", reference:"1.1.3-1squeeze6")) flag++;
if (deb_check(release:"6.0", prefix:"vlc-plugin-svgalib", reference:"1.1.3-1squeeze6")) flag++;
if (deb_check(release:"6.0", prefix:"vlc-plugin-zvbi", reference:"1.1.3-1squeeze6")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");