vlc: CVE-2009-1045 denial of service if web user interface is used

Debian Bug report logs - #522170
vlc: CVE-2009-1045 denial of service if web user interface is used

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: submit@bugs.debian.org

Subject: vlc: CVE-2009-1045 denial of service if web user interface is used

Date: Wed, 1 Apr 2009 13:17:01 +0200

[Message part 1 (text/plain, inline)]

Package: vlc
Severity: grave
Tags: security

Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for vlc.

CVE-2009-1045[0]:
| requests/status.xml in VLC 0.9.8a allows remote attackers to cause a
| denial of service (stack consumption and crash) via a long input
| argument in an in_play action.

If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1045
    http://security-tracker.debian.net/tracker/CVE-2009-1045

-- 
Nico Golde - http://www.ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[Message part 2 (application/pgp-signature, inline)]

Message #10 received at 522170@bugs.debian.org (full text, mbox, reply):

From: Christophe Mutricy <xtophe@chewa.net>

To: Nico Golde <nion@debian.org>, 522170@bugs.debian.org

Cc: control@bugs.debian.org

Subject: Re: Bug#522170: vlc: CVE-2009-1045 denial of service if web user interface is used

Date: Wed, 1 Apr 2009 21:29:05 +0200

tags 522170 - security
tags 522170 + fixed-upstream
severity 522170 normal
thanks

Le Wed 01 Apr 09 à 13:17 +0200, Nico Golde a écrit :
> CVE-2009-1045[0]:
> | requests/status.xml in VLC 0.9.8a allows remote attackers to cause a
> | denial of service (stack consumption and crash) via a long input
> | argument in an in_play action.

This is not a security issue. Because if you have access to the html
interface and want to DoS vlc, you'd quicker to click on the "Close"
button.

Anyway it's fixed in 0.9.9 which i am packaging atm.

-- 
Xtophe

Message #21 received at 522170@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: Christophe Mutricy <xtophe@chewa.net>

Cc: 522170@bugs.debian.org

Subject: Re: Bug#522170: vlc: CVE-2009-1045 denial of service if web user interface is used

Date: Thu, 2 Apr 2009 01:26:59 +0200

[Message part 1 (text/plain, inline)]

Hi,
* Christophe Mutricy <xtophe@chewa.net> [2009-04-02 00:36]:
> Le Wed 01 Apr 09 à 13:17 +0200, Nico Golde a écrit :
> > CVE-2009-1045[0]:
> > | requests/status.xml in VLC 0.9.8a allows remote attackers to cause a
> > | denial of service (stack consumption and crash) via a long input
> > | argument in an in_play action.
> 
> This is not a security issue. Because if you have access to the html
> interface and want to DoS vlc, you'd quicker to click on the "Close"
> button.
> 
> Anyway it's fixed in 0.9.9 which i am packaging atm.

Isn't this interface available if vlc is used to stream and 
serves as a http server?

Cheers
Nico
-- 
Nico Golde - http://www.ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[Message part 2 (application/pgp-signature, inline)]

Message #26 received at 522170@bugs.debian.org (full text, mbox, reply):

From: Christophe Mutricy <xtophe@chewa.net>

To: Nico Golde <nion@debian.org>

Cc: 522170@bugs.debian.org

Subject: Re: Bug#522170: vlc: CVE-2009-1045 denial of service if web user interface is used

Date: Thu, 2 Apr 2009 01:48:37 +0200

Le Thu 02 Apr 09 à 01:26 +0200, Nico Golde a écrit :
> > This is not a security issue. Because if you have access to the html
> > interface and want to DoS vlc, you'd quicker to click on the "Close"
> > button.
> 
> Isn't this interface available if vlc is used to stream and 
> serves as a http server?

No. 
VLC can stream over HTTP and VLC have an html interface but the 2 things
are completly separated.

The access to the html interface is controled by a .hosts file. The
.hosts distributed by upstream and debian allow only localhost to
connect to the html interface.

More detailed in
http://thread.gmane.org/gmane.comp.video.videolan.vlc.devel/55854/focus=55901

The CVE is likely to end-uo being marked as "disputed" or rejected


-- 
Xtophe

Message #33 received at 522170-close@bugs.debian.org (full text, mbox, reply):

From: Christophe Mutricy <xtophe@videolan.org>

To: 522170-close@bugs.debian.org

Subject: Bug#522170: fixed in vlc 0.9.9a-1

Date: Sun, 05 Apr 2009 07:03:18 +0000

Source: vlc
Source-Version: 0.9.9a-1

We believe that the bug you reported is fixed in the latest version of
vlc, which is due to be installed in the Debian FTP archive:

libvlc-dev_0.9.9a-1_i386.deb
  to pool/main/v/vlc/libvlc-dev_0.9.9a-1_i386.deb
libvlc2_0.9.9a-1_i386.deb
  to pool/main/v/vlc/libvlc2_0.9.9a-1_i386.deb
libvlccore-dev_0.9.9a-1_i386.deb
  to pool/main/v/vlc/libvlccore-dev_0.9.9a-1_i386.deb
libvlccore0_0.9.9a-1_i386.deb
  to pool/main/v/vlc/libvlccore0_0.9.9a-1_i386.deb
mozilla-plugin-vlc_0.9.9a-1_i386.deb
  to pool/main/v/vlc/mozilla-plugin-vlc_0.9.9a-1_i386.deb
vlc-data_0.9.9a-1_all.deb
  to pool/main/v/vlc/vlc-data_0.9.9a-1_all.deb
vlc-dbg_0.9.9a-1_i386.deb
  to pool/main/v/vlc/vlc-dbg_0.9.9a-1_i386.deb
vlc-nox_0.9.9a-1_i386.deb
  to pool/main/v/vlc/vlc-nox_0.9.9a-1_i386.deb
vlc-plugin-arts_0.9.9a-1_i386.deb
  to pool/main/v/vlc/vlc-plugin-arts_0.9.9a-1_i386.deb
vlc-plugin-esd_0.9.9a-1_i386.deb
  to pool/main/v/vlc/vlc-plugin-esd_0.9.9a-1_i386.deb
vlc-plugin-ggi_0.9.9a-1_i386.deb
  to pool/main/v/vlc/vlc-plugin-ggi_0.9.9a-1_i386.deb
vlc-plugin-jack_0.9.9a-1_i386.deb
  to pool/main/v/vlc/vlc-plugin-jack_0.9.9a-1_i386.deb
vlc-plugin-pulse_0.9.9a-1_i386.deb
  to pool/main/v/vlc/vlc-plugin-pulse_0.9.9a-1_i386.deb
vlc-plugin-sdl_0.9.9a-1_i386.deb
  to pool/main/v/vlc/vlc-plugin-sdl_0.9.9a-1_i386.deb
vlc-plugin-svgalib_0.9.9a-1_i386.deb
  to pool/main/v/vlc/vlc-plugin-svgalib_0.9.9a-1_i386.deb
vlc_0.9.9a-1.diff.gz
  to pool/main/v/vlc/vlc_0.9.9a-1.diff.gz
vlc_0.9.9a-1.dsc
  to pool/main/v/vlc/vlc_0.9.9a-1.dsc
vlc_0.9.9a-1_i386.deb
  to pool/main/v/vlc/vlc_0.9.9a-1_i386.deb
vlc_0.9.9a.orig.tar.gz
  to pool/main/v/vlc/vlc_0.9.9a.orig.tar.gz



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 522170@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Christophe Mutricy <xtophe@videolan.org> (supplier of updated vlc package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Fri, 03 Apr 2009 00:12:49 +0200
Source: vlc
Binary: vlc vlc-dbg vlc-nox libvlccore0 libvlc2 libvlccore-dev libvlc-dev vlc-plugin-esd vlc-plugin-sdl vlc-plugin-ggi vlc-plugin-arts mozilla-plugin-vlc vlc-plugin-svgalib vlc-plugin-jack vlc-plugin-pulse vlc-data
Architecture: source all i386
Version: 0.9.9a-1
Distribution: unstable
Urgency: low
Maintainer: Debian multimedia packages maintainers <pkg-multimedia-maintainers@lists.alioth.debian.org>
Changed-By: Christophe Mutricy <xtophe@videolan.org>
Description: 
 libvlc-dev - development files for libvlc
 libvlc2    - multimedia player and streamer library
 libvlccore-dev - development files for libvlccore
 libvlccore0 - base library for VLC and its modules
 mozilla-plugin-vlc - multimedia plugin for web browsers based on VLC
 vlc        - multimedia player and streamer
 vlc-data   - Common data for VLC
 vlc-dbg    - debugging symbols for vlc
 vlc-nox    - multimedia player and streamer (without X support)
 vlc-plugin-arts - aRts audio output plugin for VLC
 vlc-plugin-esd - Esound audio output plugin for VLC
 vlc-plugin-ggi - GGI video output plugin for VLC
 vlc-plugin-jack - Jack audio plugins for VLC
 vlc-plugin-pulse - PulseAudio plugin for VLC
 vlc-plugin-sdl - SDL video and audio output plugin for VLC
 vlc-plugin-svgalib - SVGAlib video output plugin for VLC
Closes: 520149 522040 522170 522185 522554
Changes: 
 vlc (0.9.9a-1) unstable; urgency=low
 .
   * New upstream version 0.9.9a
    + Closes: #520149, #522170, #522185, #522554
    + Update symbol files
   * Fix some typo in bug/presubj
   * Remove some Replaces/Conflicts against version not in etch
   * Move the caca module to vlc-nox
     + Re-add some Replaces/Conflicts
     + Closes: #522040
Checksums-Sha1: 
 f8632c6b94102d2a0d800353e64393a42820b4e9 3269 vlc_0.9.9a-1.dsc
 34fed4cc016ac7ebfd4d33855ae35f7ab9086d71 24017642 vlc_0.9.9a.orig.tar.gz
 fdca8354cdaea27fc2d65b2dd6fba79481d6ba02 47881 vlc_0.9.9a-1.diff.gz
 5652eade8ebff9059ced180c44768994699b7ed4 5861254 vlc-data_0.9.9a-1_all.deb
 37f2a403dfdc034252d2ce7b2020b5d00778b6e9 1658358 vlc_0.9.9a-1_i386.deb
 a9de0aa9ac8de5a0406fb9ea5e834c06b9e59817 10891696 vlc-dbg_0.9.9a-1_i386.deb
 d37a31e6c7e20164d0907e66461831561dad1861 2749162 vlc-nox_0.9.9a-1_i386.deb
 1a9fa73d580d31c64ec4bf14a015b5aeee13392b 391172 libvlccore0_0.9.9a-1_i386.deb
 a77894306de5fecc0fe54d6e4a66c853d4b5c775 46328 libvlc2_0.9.9a-1_i386.deb
 e83d729c2bd23e476463a4b615db530846e07c5a 526536 libvlccore-dev_0.9.9a-1_i386.deb
 7abee4e824abc339e82d38f6f0bb74f23be4495f 62178 libvlc-dev_0.9.9a-1_i386.deb
 32ebe9f400e3b6fa7e495d82c78f74efe111c243 4654 vlc-plugin-esd_0.9.9a-1_i386.deb
 c8cb33c7bea7a6b52d9f24049d7ec63032831647 11446 vlc-plugin-sdl_0.9.9a-1_i386.deb
 3f2caca3fd7184698771483a86ff26a30aba534f 5876 vlc-plugin-ggi_0.9.9a-1_i386.deb
 cb9ba3d31bc8723943a74ea7f8b2b3be7731929f 3900 vlc-plugin-arts_0.9.9a-1_i386.deb
 895b19cb8d325e8ac78de572ae606b23699805ca 38114 mozilla-plugin-vlc_0.9.9a-1_i386.deb
 8a9508bd067a25e79d9fc0c66a676cf17665d46f 4478 vlc-plugin-svgalib_0.9.9a-1_i386.deb
 048ae32dca36e6106a72f457eb02852df7ad031c 10540 vlc-plugin-jack_0.9.9a-1_i386.deb
 2d0c5bce238f3ad5b29746466c9f57148e7f23fb 6758 vlc-plugin-pulse_0.9.9a-1_i386.deb
Checksums-Sha256: 
 6392ad896369eedee31bdf2f3ef98534ad3ddb738e515dd3a4063417b6a78982 3269 vlc_0.9.9a-1.dsc
 3114b90bfe77085eaf795acf7149a20d075ddc284fb02393f75875a8c5e38fa7 24017642 vlc_0.9.9a.orig.tar.gz
 9262b2a22c91008d691b32fffee76e2aa746b349ccd27cc7c1a1494a32f72fbd 47881 vlc_0.9.9a-1.diff.gz
 65d5be6cea81b84176b7306e8777f108f6e33d30369955c7f95b251fffdfed4c 5861254 vlc-data_0.9.9a-1_all.deb
 daa528c8e37eea61185ddd3aa2f819c00ef12b9c87b7fa259f0a3fdc8e50e6f2 1658358 vlc_0.9.9a-1_i386.deb
 7fb96798cfaa9cb80359c11011c24cfd056454350701bd3f7a1ba4e09a1328ab 10891696 vlc-dbg_0.9.9a-1_i386.deb
 272295682a60616038ad4c108909b3fea7e4530b82494b5d73ce785b119a4192 2749162 vlc-nox_0.9.9a-1_i386.deb
 8760fb9f69d44b69d9a228db051b0d8c576119d6b80cd9128cdeeea1e04cdccf 391172 libvlccore0_0.9.9a-1_i386.deb
 08f405e914a6ac32de09eb4bdf821e0fc5e7d62d0c08eaa086f77e6a60cfa194 46328 libvlc2_0.9.9a-1_i386.deb
 ca2a1e173637e924964a342b787bac6a97c7ae337b6d5a610afb81d5379bd880 526536 libvlccore-dev_0.9.9a-1_i386.deb
 13b0571eb346b75b9fbca88c0e6e8967df474d4368e4c859999d053f798d4d0c 62178 libvlc-dev_0.9.9a-1_i386.deb
 f7f8aa197f56bb7d2882d732056b50d32a1a973ceb6312b5e878368e1fc4439e 4654 vlc-plugin-esd_0.9.9a-1_i386.deb
 6bfc88dc90585eb1ff7f1a3dc6fa4a67043e8d7752239c9ee39796bcbc7b4f3d 11446 vlc-plugin-sdl_0.9.9a-1_i386.deb
 d585fa3831d18d0c2f11c7399d535d17dd6d6986267f833d4520f2a1f6670694 5876 vlc-plugin-ggi_0.9.9a-1_i386.deb
 f0f7d0d06ca8948ae162ba177de9f0606af0c745d67ac59c396074037eac4e8d 3900 vlc-plugin-arts_0.9.9a-1_i386.deb
 6be644f0f7a6d70ee069cda14a0c021f7d4f121af45e4df9ac530077cc3d0560 38114 mozilla-plugin-vlc_0.9.9a-1_i386.deb
 882019d1e3990f1b97d410cfabc76404178614808794ff4f59b546498fd61d4d 4478 vlc-plugin-svgalib_0.9.9a-1_i386.deb
 35d1f59c8cc3f0927998080cdf262fe0b2e212ce958f5a6a52af72bc3d4340e6 10540 vlc-plugin-jack_0.9.9a-1_i386.deb
 348479e60752e369789f48190324986635d23d8109f2e5944853c1542c55ff75 6758 vlc-plugin-pulse_0.9.9a-1_i386.deb
Files: 
 dadc63efdb0f9492453a636cecbe2d9a 3269 video optional vlc_0.9.9a-1.dsc
 6815243c407137578a26bf3bb03ce5cd 24017642 video optional vlc_0.9.9a.orig.tar.gz
 8e018464ce88f13c6118613f78430bc5 47881 video optional vlc_0.9.9a-1.diff.gz
 957e49437fcb9e2d1940c66a63c7e18f 5861254 video optional vlc-data_0.9.9a-1_all.deb
 e882b67f62e4a633d5c4b0cc49dc3ef3 1658358 video optional vlc_0.9.9a-1_i386.deb
 0d32c2d8485318a93e1ad7d417f78503 10891696 debug extra vlc-dbg_0.9.9a-1_i386.deb
 1cf35e74f8e9df696219b62375af8236 2749162 video optional vlc-nox_0.9.9a-1_i386.deb
 d99a3b05d25a0b8ffda77028a26ec6b7 391172 libs optional libvlccore0_0.9.9a-1_i386.deb
 054bbf256e47ba098685bf8b342f5a38 46328 libs optional libvlc2_0.9.9a-1_i386.deb
 13164a654c1b073f690a43047a218c37 526536 libdevel optional libvlccore-dev_0.9.9a-1_i386.deb
 a15efefc31cbbdf07b8ed3db62a8513c 62178 libdevel optional libvlc-dev_0.9.9a-1_i386.deb
 069ebb1d576fa3aa7312b6507ac19b6c 4654 video optional vlc-plugin-esd_0.9.9a-1_i386.deb
 ce8a1982efa216a3db271354303ca948 11446 video optional vlc-plugin-sdl_0.9.9a-1_i386.deb
 6b5ecd91869c4a0619de04214152f779 5876 video optional vlc-plugin-ggi_0.9.9a-1_i386.deb
 92054a6bf54c2c4697b5d49d40ebcb18 3900 video optional vlc-plugin-arts_0.9.9a-1_i386.deb
 f7b6e4c377bba0b430f549177308db30 38114 video optional mozilla-plugin-vlc_0.9.9a-1_i386.deb
 f1d80776b7a01f5e54cd9ca2795eae58 4478 video optional vlc-plugin-svgalib_0.9.9a-1_i386.deb
 3ffa196d982173f86c17d1e28d4fecb7 10540 video optional vlc-plugin-jack_0.9.9a-1_i386.deb
 8d13c78113d920c8e606e0ebce6cb3ff 6758 video optional vlc-plugin-pulse_0.9.9a-1_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Debian Powered!

iJwEAQECAAYFAknYU6wACgkQ78RAoABp8o92nAP/Y4V6wMV0gJRr5udD13AoIOZs
qM9RpkCilgBMsfnEbEU1dfU2qS0r289lR3IrZnfc8lsnpB66ivMpX778QhqgUjRL
2L0GsX2ORZ8G2j0uWrIU74yXqNRYPi2kfQ8IhjXZ8CBNMSeNN8BVAOSPUjWfr3uE
P0QkTWExP8tO/bsPhN0=
=dD/Z
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.