A few days ago, a German security agency CERT-Bund revealed it had found a Remote Code Execution (RCE) flaw in the popular open-source, VLC Media Player allowing hackers to install, modify, or run any software on a victim’s device without their authority and could also be used to disclose files on the host system.
The vulnerability (listed as CVE-2019-13615) was first announced by WinFuture and received a vulnerability score of 9.8 making it a “critical” problem.
According to a release by CERT-Bund, “A remote, anonymous attacker can exploit a vulnerability in VLC to execute arbitrary code, create a denial of service state, disclose information, or manipulate files.”
According to Threat Post, “Specifically, VLC media player’s heap-based buffer over-read vulnerability exists in mkv::demux_sys_t::FreeUnused() in the media player’s modules/demux/mkv/demux.cpp function when called from mkv::Open in modules/demux/mkv/mkv.cpp.”
VLC is not vulnerable, VideoLAN says
Yesterday, VideoLAN, the makers of VLC, tweeted that VLC is not vulnerable. They said, “the issue is in a 3rd party library, called libebml, which was fixed more than 16 months ago. VLC since version 3.0.3 has the correct version shipped, and @MITREcorp did not even check their claim.”
About the "security issue" on #VLC : VLC is not vulnerable.
tl;dr: the issue is in a 3rd party library, called libebml, which was fixed more than 16 months ago.
VLC since version 3.0.3 has the correct version shipped, and @MITREcorp did not even check their claim.Thread:
— VideoLAN (@videolan) July 24, 2019
VideoLAN said a reporter, opened a bug on their public bug tracker, which is outside of the reporting policy and should have mailed in private on the security alias. “We could not, of course, reproduce the issue, and tried to contact the security researcher, in private”, VideoLAN tweeted.
VideoLAN said the reporter was using Ubuntu 18.04, an old version of Ubuntu and “clearly has not all the updated libraries. But did not answer our questions.”
VideoLAN says it wasn’t contacted before the CVE was issued
VideoLAN is quite unhappy that MITRE Corp did not approach them before issuing a CVE for the VLC vulnerability, which is a direct violation of MITRE’s own policies.
Source: CVE.mitre.org
This is not the first time that @MITREcorp does that.
In fact, they NEVER EVER contact us when they find security issues on VLC, and we always discover that after they are public, when a user or a distribution asks us.— VideoLAN (@videolan) July 24, 2019
When VideoLAN complained and asked if they could manage their own CVE (like another CNA), “we had no answer and @usnistgov NVD told us that they basically couldn’t do anything for us, not even fixing the wrong information”, they tweeted.
When we complained, and we asked if we could manage our own CVE (like another CNA), we had no answer and @usnistgov NVD told us that they basically couldn't do anything for us, not even fixing the wrong information.
— VideoLAN (@videolan) July 24, 2019
VideoLAN said even CERT Bund did not contact them for clarifications. They further added, “So, when @certbund decided to do their “disclosure”, all the media jumped in, without checking anything nor contacting us.”
And to finish, both @usnistgov NVD and @MITREcorp were contacted more than 12 hours, (7pm CET) and we still are waiting for an answer, while @elpaisinenglish is asking us for clarifications…
— VideoLAN (@videolan) July 24, 2019
The VLC CVE on the National Vulnerability Database has now been updated. NVD has downgraded the severity of the issue from a Base Score of 9.8 (critical) to 5.5 (medium). Also, the changelog specifies that the “Victim must voluntarily interact with attack mechanism.”
Dan Kaminsky, an American security researcher, tweeted, “A couple of things, though:
1) Ubuntu 18.04 is not some ancient version
2) Playing videos with VLC is both a first-class user demand and a major attack surface, given the realities of content sourcing. If Ubuntu can’t secure VLC dependencies, VLC probably has to ship local libs.”
Just to be clear on this:
If VLC opens a video, and arbitrary code starts running, somebody has to fix something.
"Who's bug is it, anyway?" is absolutely a real thing, and my assessment right now is that this is an unusually messy case because many vendors are involved.
— Dan Kaminsky (@dakami) July 24, 2019
Last month, VideoLAN fixed two high severity bugs in their security update for the VLC media player. The update included fixes for 33 vulnerabilities in total, of which two were marked critical, 21 medium and 10 rated low.
Jean-Baptiste Kempf, president of VideoLAN and an open-source developer, wrote, “This high number of security issues is due to the sponsoring of a bug bounty program funded by the European Commission, during the Free and Open Source Software Audit (FOSSA) program”.
To know more about this news in detail, you can read WinFuture’s blog post.
Read Next
The EU Bounty Program enabled in VLC 3.0.7 release, this version fixed the most number of security issues
