Malicious subtitle file could trip up VLC media player
A flaw in the widely-used open-source VLC media player could allow an attacker
to execute harmful code on a PC.
The problem stems from a buffer overflow that can occur when the player processes
subtitle files used for movies, according
to a security advisory.
The vulnerability existed before VLC was upgraded to version 0.8.6e in late
February, but the bug appears to have escaped the last round of patches, wrote
Luigi Auriemma in a note.
"The funny thing is that my old proof-of-concept was built just to test
this specific buffer overflow, and in fact it works on the new VLC version too
without modifications," Auriemma wrote.
Video files can contain a link to a separate subtitle file, which VLC automatically
loads when it plays the video. An attacker could use the buffer overflow flaw
in VLC to execute malicious code contained in a subtitle file, and thus tamper
with a PC. The flaw affects VLC players running on Windows, Mac, BSD and possibly
more operating systems, Auriemma wrote.
The VLC media player is part of the VideoLAN
project. The player is free, and it is released under the GNU General Public
License. VLC can also be used as a streaming media server for a variety of platforms.
IDG News Service
Symantec Backup Exec 12 and Backup Exec System Recovery 8 deliver industry leading Windows data protection and system recovery. Download this whitepaper to find out the top reasons to upgrade and how to get continuous data protection and complete system recovery.
Data and system loss — from a hard drive failure, malicious attack, natural disaster, or simple human error — can happen anytime. Don’t leave your business vulnerable. Make sure you have a secure recovery strategy in place. Symantec's latest backup and system recovery technology can efficiently restore critical applications, individual emails and documents and even restore your entire system in minutes in the event of a loss.
Businesses face a growing challenge to ensure that the IT environment is properly protected. Backup Exec 12 integrates with other applications in the Symantec family of products, to complement your current data protection strategy, keep your data securely backed up and make it recoverable when you need it most.
VMware ESX Server in the Enterprise
By Edward L. Haletky
Published Dec 29, 2007 by Prentice Hall.
Enter now! | Official rules | Sample chapter
Green IT
By Toby Velte, Anthony Velte, Robert C. Elsenpeter
To be published Oct. 10, 2008 by McGraw Hill Professional
Enter now! | Official rules | About the book
