14 DAY TRIAL // The VideoLAN Project warns about a critical buffer overflow vulnerability in VLC media player which can be exploited to execute arbitrary code remotely.
The vulnerability was confirmed in VLC media player 1.1.5, the latest stable version, but previous releases could also be affected.
The bug is located in the Real demuxer plugin which handles the playback of multimedia files in the Real Media format.
"The vulnerability is caused due to an array indexing error within the Real demuxer when processing certain Real Media files," explains vulnerability research vendor Secunia, which rates this flaw as highly critical.
It can be exploited by tricking VLC users into opening a specially crafted Real Media file. The file can be located on a network share or even on a website, if the intended victim has the optional VLC browser plugins installed.
VLC developers credit Dan Rosenberg from VSR (Virtual Security Research) for discovering and reporting the vulnerability.
They also claim the issue was fixed in VLC media player 1.1.6, which has yet to be released. Source code patches for older versions are also available, but they must be applied manually before compilation.
A workaround involves avoiding opening files from untrusted sources or removing the libreal_plugin.* file from the VLC installation folder if Real Media playback is not necessary.
Users are also advised to disable the VLC ActiveX control from Internet Explorer and the VLC Firefox plug-in, in order to stay clear from future drive-by download attacks looking to exploit this flaw.
VLC is a powerful cross-platform multimedia player capable of playing most media formats natively, without the need of additional codecs. It is open source and distributed under the GNU General Public License.
The latest version of VLC media player for Windows can be downloaded from here.
The latest version of VLC media player for Mac can be downloaded from here.