Vulnerability Name:

CVE-2008-2147 (CCN-42377)

Assigned:2008-05-10
Published:2008-05-10
Updated:2017-08-08
Summary:Untrusted search path vulnerability in VideoLAN VLC before 0.9.0 allows local users to execute arbitrary code via a malicious library under the modules/ or plugins/ subdirectories of the current working directory.
CVSS v3 Severity:9.3 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:4.6 Medium (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
3.4 Low (Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
6.9 Medium (CCN CVSS v2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C)
5.1 Medium (CCN Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-264
Vulnerability Consequences:Gain Privileges
References:Source: MITRE
Type: CNA
CVE-2008-2147

Source: CCN
Type: VideoLan Commit page
git.videolan.org / vlc.git / commit

Source: CONFIRM
Type: UNKNOWN
http://git.videolan.org/?p=vlc.git;a=commit;h=c7cef4fdd8dd72ce0a45be3cda8ba98df5e83181

Source: SECUNIA
Type: UNKNOWN
31317

Source: GENTOO
Type: UNKNOWN
GLSA-200807-13

Source: CCN
Type: VLC Ticket #1578
VLC executes arbitrary plugins

Source: CONFIRM
Type: UNKNOWN
http://trac.videolan.org/vlc/ticket/1578

Source: DEBIAN
Type: DSA-1819
vlc -- several vulnerabilities

Source: CCN
Type: GLSA-200807-13
VLC: Multiple vulnerabilities

Source: CCN
Type: OSVDB ID: 45187
VLC modules / plugins Subdirectory Search Path Subversion Local Privilege Escalation

Source: CCN
Type: VideoLAN Web site
VLC media player

Source: XF
Type: UNKNOWN
vlc-searchpath-code-execution(42377)

Source: XF
Type: UNKNOWN
vlc-searchpath-code-execution(42377)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:videolan:vlc:0.4.6:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc:0.5.0:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc:0.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc:0.5.1a:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc:0.5.2:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc:0.5.3:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc:0.6.0:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc:0.6.1:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc:0.6.2:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc:0.7.0:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc:0.7.1:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc:0.7.2:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc:0.8.0:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc:0.8.1:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc:0.8.2:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc:0.8.4:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc:0.8.4a:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc:0.8.5:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc:*:*:*:*:*:*:*:* (Version <= 0.8.6)
  • OR cpe:/a:videolan:vlc:0.8.6a:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc:0.8.6b:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc:0.8.6c:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc:0.8.6d:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc:0.8.6e:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:videolan:vlc_media_player:0.8.6:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.8.6a:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.8.6d:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.8.6e:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.4.6:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.5.0:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.5.2:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.5.3:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.6.0:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.6.1:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.6.2:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.7.0:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.7.1:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.7.2:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.8.0:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.8.1:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.8.2:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.8.4:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.8.4a:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.8.5:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.8.6b:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.8.6c:*:*:*:*:*:*:*
  • AND
  • cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:8254
    P
    		DSA-1819 vlc -- several vulnerabilities
    2014-06-23
    oval:org.mitre.oval:def:13455
    P
    		DSA-1819-1 vlc -- several vulnerabilities
    2014-06-23
    oval:org.debian:def:1819
    V
    		several vulnerabilities
    2009-06-18
    BACK
    videolan vlc 0.4.6
    videolan vlc 0.5.0
    videolan vlc 0.5.1
    videolan vlc 0.5.1a
    videolan vlc 0.5.2
    videolan vlc 0.5.3
    videolan vlc 0.6.0
    videolan vlc 0.6.1
    videolan vlc 0.6.2
    videolan vlc 0.7.0
    videolan vlc 0.7.1
    videolan vlc 0.7.2
    videolan vlc 0.8.0
    videolan vlc 0.8.1
    videolan vlc 0.8.2
    videolan vlc 0.8.4
    videolan vlc 0.8.4a
    videolan vlc 0.8.5
    videolan vlc *
    videolan vlc 0.8.6a
    videolan vlc 0.8.6b
    videolan vlc 0.8.6c
    videolan vlc 0.8.6d
    videolan vlc 0.8.6e
    videolan vlc media player 0.8.6
    videolan vlc media player 0.8.6a
    videolan vlc media player 0.8.6d
    videolan vlc media player 0.8.6e
    videolan vlc media player 0.4.6
    videolan vlc media player 0.5.0
    videolan vlc media player 0.5.1
    videolan vlc media player 0.5.2
    videolan vlc media player 0.5.3
    videolan vlc media player 0.6.0
    videolan vlc media player 0.6.1
    videolan vlc media player 0.6.2
    videolan vlc media player 0.7.0
    videolan vlc media player 0.7.1
    videolan vlc media player 0.7.2
    videolan vlc media player 0.8.0
    videolan vlc media player 0.8.1
    videolan vlc media player 0.8.2
    videolan vlc media player 0.8.4
    videolan vlc media player 0.8.4a
    videolan vlc media player 0.8.5
    videolan vlc media player 0.8.6b
    videolan vlc media player 0.8.6c
    gentoo linux *
    debian debian linux 4.0