Vulnerabilities > CVE-2017-8310 - Out-of-bounds Read vulnerability in Videolan VLC Media Player

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(100592);
  script_version("1.8");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/12");

  script_cve_id(
    "CVE-2017-8310",
    "CVE-2017-8311",
    "CVE-2017-8313",
    "CVE-2017-9300",
    "CVE-2017-9301"
  ); 
  script_bugtraq_id(98746, 98747, 98633, 98634, 98638);

  script_name(english:"VLC Media Player < 2.2.5 Multiple Vulnerabilities");
  script_summary(english:"Checks the VLC media player version.");

  script_set_attribute(attribute:"synopsis", value:
"A media player installed on the remote host is affected by multiple
vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of VLC media player installed on the remote host is prior
to 2.2.5. It is, therefore, affected by the multiple vulnerabilities :

  - A denial of service vulnerability exists within file plugins\audio_filter\libmpgatofixed32_plugin.dll when
    parsing media files due to improper validation of user-supplied input. An unauthenticated, remote attacker
    can exploit this, via a specially crafted file, to crash the application. (CVE-2017-9301)

  - A flaw exists, related to a ParseJSS null skip, when handling specially crafted subtitle files downloaded by
    the media player. An unauthenticated, remote attacker can exploit this, via a specially crafted file, to
    execute arbitrary code.

  - A heap-based buffer overflow condition exists due to improper validation of user-supplied input. An unauthenticated, 
    remote attacker can exploit this, via a specially crafted AVI file, to execute arbitrary code.

  - A memory corruption issue exists when handling LPCM in VOB files. An unauthenticated, remote attacker can
    exploit this, via a specially crafted file, to execute arbitrary code.
    
  - An exploitable vulnerability exists in plugins\codec\libflac_plugin.dll, allows remote attackers to cause 
    denial of service (heap corruption and application crash) or possibly have unspecified other impact via a crafted 
    FLAC file. (CVE-2017-9300). 

  - An exploitable Heap out-of-bound read vulnerability exists in ParseJSS of VideoLan VLC. This is due to missing check of 
    string termination allows attackers to read data beyond allocated memory and potentially crash the process via a crafted 
    subtitles file. (CVE-2017-8313).

  - An exploitable heap based buffer overflow vulnerability exists in ParseJSS of VideoLan VLC. This is due to skipping NULL 
    terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file. (CVE-2017-8311).

  - An exploitable Heap out-of-bound read vulnerability exists in CreateHtmlSubtitle of VideoLan VLC. This is due to missing 
    check of string termination allows attackers to read data beyond allocated memory and potentially crash the process 
    (causing a denial of service) via a crafted subtitles file. (CVE-2017-8310).");
  script_set_attribute(attribute:"see_also", value:"http://www.videolan.org/developers/vlc-branch/NEWS");
  script_set_attribute(attribute:"see_also", value:"http://www.videolan.org/vlc/releases/2.2.5.html");
  script_set_attribute(attribute:"see_also", value:"https://trac.videolan.org/vlc/ticket/17448");
  script_set_attribute(attribute:"see_also", value:"https://fortiguard.com/zeroday/FG-VD-16-067");
  script_set_attribute(attribute:"see_also", value:"https://fortiguard.com/zeroday/FG-VD-16-090");
  # https://www.engadget.com/2017/05/24/security-flaw-in-media-player-subtitles/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?472b5bc4");
  script_set_attribute(attribute:"solution", value:
"Upgrade to VLC version 2.2.5 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-9301");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/08/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2016/09/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/06/02");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:videolan:vlc_media_player");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("vlc_installed.nasl");
  script_require_keys("installed_sw/VLC media player");

  exit(0);
}

include("vcf.inc");

app_name = "VLC media player";

app_info = vcf::get_app_info(app:app_name, win_local:TRUE);

constraints = [{"fixed_version":"2.2.5"}];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Debian Security Advisory DSA-3899. The text 
# itself is copyright (C) Software in the Public Interest, Inc.
#

include("compat.inc");

if (description)
{
  script_id(101066);
  script_version("3.7");
  script_cvs_date("Date: 2018/11/10 11:49:38");

  script_cve_id("CVE-2017-8310", "CVE-2017-8311", "CVE-2017-8312", "CVE-2017-8313");
  script_xref(name:"DSA", value:"3899");

  script_name(english:"Debian DSA-3899-1 : vlc - security update");
  script_summary(english:"Checks dpkg output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Debian host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Several vulnerabilities have been found in VLC, the VideoLAN project's
media player. Processing malformed subtitles or movie files could lead
to denial of service and potentially the execution of arbitrary code."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://packages.debian.org/source/jessie/vlc"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.debian.org/security/2017/dsa-3899"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"Upgrade the vlc packages.

For the oldstable distribution (jessie), these problems have been
fixed in version 2.2.6-1~deb8u1."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:vlc");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:8.0");

  script_set_attribute(attribute:"patch_publication_date", value:"2017/06/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/06/28");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Debian Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("debian_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (deb_check(release:"8.0", prefix:"libvlc-dev", reference:"2.2.6-1~deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"libvlc5", reference:"2.2.6-1~deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"libvlccore-dev", reference:"2.2.6-1~deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"libvlccore8", reference:"2.2.6-1~deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"vlc", reference:"2.2.6-1~deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"vlc-data", reference:"2.2.6-1~deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"vlc-dbg", reference:"2.2.6-1~deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"vlc-nox", reference:"2.2.6-1~deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"vlc-plugin-fluidsynth", reference:"2.2.6-1~deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"vlc-plugin-jack", reference:"2.2.6-1~deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"vlc-plugin-notify", reference:"2.2.6-1~deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"vlc-plugin-pulse", reference:"2.2.6-1~deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"vlc-plugin-samba", reference:"2.2.6-1~deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"vlc-plugin-sdl", reference:"2.2.6-1~deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"vlc-plugin-svg", reference:"2.2.6-1~deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"vlc-plugin-zvbi", reference:"2.2.6-1~deb8u1")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
  else security_warning(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");