Vulnerability CVE-2008-1768 - CERT Civis.Net

Vulnerability Name:

CVE-2008-1768 (CCN-42030)

Assigned:

2008-04-23

Published:

2008-04-23

Updated:

2017-09-29

Summary:

Multiple integer overflows in VLC before 0.8.6f allow remote attackers to cause a denial of service (crash) via the (1) MP4 demuxer, (2) Real demuxer, and (3) Cinepak codec, which triggers a buffer overflow.

CVSS v3 Severity:

7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: CCN
Type: Gentoo Bugzilla Bug 214627
media-video/vlc <0.8.6f Multiple Vulnerabilities (CVE-2008-{1489,1768,1769})

Source: MITRE
Type: CNA
CVE-2008-1768

Source: CCN
Type: SA29503
VLC Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
29503

Source: SECUNIA
Type: UNKNOWN
29800

Source: CCN
Type: SA29974
Kantaris Multiple Vulnerabilities

Source: GENTOO
Type: UNKNOWN
GLSA-200804-25

Source: CONFIRM
Type: UNKNOWN
http://wiki.videolan.org/Changelog/0.8.6f

Source: DEBIAN
Type: DSA-1819
vlc -- several vulnerabilities

Source: CCN
Type: GLSA-200804-25
VLC: User-assisted execution of arbitrary code

Source: CCN
Type: OSVDB ID: 44716
VLC Real Demuxer Remote Overflow DoS

Source: CCN
Type: OSVDB ID: 44717
VLC MP4 Demuxer Remote Overflow DoS

Source: CCN
Type: OSVDB ID: 44718
VLC Cinepak Codec Remote Overflow DoS

Source: BID
Type: UNKNOWN
28903

Source: CCN
Type: BID-28903
VLC Media Player MP4 Demuxer Buffer Overflow Vulnerability

Source: CCN
Type: BID-28939
Kantaris SSA Subtitle File Remote Buffer Overflow Vulnerability

Source: CONFIRM
Type: UNKNOWN
http://www.videolan.org/developers/vlc/NEWS

Source: CONFIRM
Type: UNKNOWN
http://www.videolan.org/security/sa0803.php

Source: CCN
Type: VideoLAN Web site
VLC media player

Source: VUPEN
Type: UNKNOWN
ADV-2008-0985

Source: XF
Type: UNKNOWN
vlcmediaplayer-multiple-bo(42030)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:14412

Vulnerable Configuration:

Configuration 1:

cpe:/a:videolan:vlc:0.1.99:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.1.99a:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.1.99b:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.1.99c:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.1.99d:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.1.99e:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.1.99f:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.1.99g:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.1.99h:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.1.99i:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.2.0:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.2.50:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.2.60:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.2.61:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.2.62:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.2.63:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.2.70:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.2.71:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.2.72:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.2.73:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.2.80:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.2.81:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.2.82:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.2.83:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.2.90:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.2.91:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.2.92:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.3.0:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.3.1:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.4.0:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.4.1:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.4.2:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.4.3:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.4.3_ac3:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.4.4:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.4.5:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.4.6:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.5.0:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.5.1:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.5.2:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.5.3:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.6.0:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.6.1:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.6.2:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.7.0:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.7.1:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.7.2:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.8.0:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.8.1:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.8.2:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.8.4:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.8.4a:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.8.5:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.8.6:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.8.6a:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.8.6b:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.8.6c:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.8.6d:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.8.6e:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc:0.8.1337:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:videolan:vlc_media_player:0.8.6:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.8.6a:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.8.6d:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.8.6e:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.1.99a:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.1.99a:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.1.99b:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.1.99c:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.1.99d:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.1.99e:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.1.99f:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.1.99g:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.1.99h:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.1.99i:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.2.0:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.2.50:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.2.60:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.2.61:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.2.62:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.2.63:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.2.70:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.2.71:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.2.72:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.2.73:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.2.80:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.2.81:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.2.82:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.2.83:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.2.90:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.2.91:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.2.92:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.3.0:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.3.1:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.4.0:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.4.1:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.4.2:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.4.3:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.4.4:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.4.5:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.4.6:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.5.0:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.5.1:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.5.2:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.5.3:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.6.0:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.6.1:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.6.2:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.7.0:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.7.1:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.7.2:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.8.0:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.8.1:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.8.1337:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.8.2:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.8.4:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.8.4a:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.8.5:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.8.6b:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.8.6c:*:*:*:*:*:*:*

AND

cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*

OR cpe:/o:debian:debian_linux:4.0:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.mitre.oval:def:8254	P	DSA-1819 vlc -- several vulnerabilities	2014-06-23
oval:org.mitre.oval:def:13455	P	DSA-1819-1 vlc -- several vulnerabilities	2014-06-23
oval:org.mitre.oval:def:14412	V	Multiple integer overflows in VLC before 0.8.6f allow remote denial of service	2012-11-19
oval:org.debian:def:1819	V	several vulnerabilities	2009-06-18