Vulnerability CVE-2008-5032

Vulnerability Name:

CVE-2008-5032 (CCN-46375)

Assigned:

2008-11-05

Published:

2008-11-05

Updated:

2018-10-11

Summary:

Stack-based buffer overflow in VideoLAN VLC media player 0.5.0 through 0.9.5 might allow user-assisted attackers to execute arbitrary code via the header of an invalid CUE image file, related to modules/access/vcd/cdrom.c.
Note: this identifier originally included an issue related to RealText, but that issue has been assigned a separate identifier, CVE-2008-5036.

CVSS v3 Severity:

7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
7.3 High (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.3 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

CWE-119

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2008-5032

Source: CONFIRM
Type: UNKNOWN
http://git.videolan.org/?p=vlc.git;a=commitdiff;h=5f63f1562d43f32331006c2c1a61742de031b84d

Source: CCN
Type: SA32569
VLC Media Player CUE and RealText Processing Buffer Overflows

Source: SECUNIA
Type: Vendor Advisory
32569

Source: SECUNIA
Type: Vendor Advisory
33315

Source: GENTOO
Type: UNKNOWN
GLSA-200812-24

Source: DEBIAN
Type: DSA-1819
vlc -- several vulnerabilities

Source: CCN
Type: GLSA-200812-24
VLC: Multiple vulnerabilities

Source: MLIST
Type: UNKNOWN
[oss-security] 20081105 VideoLAN security advisory 0810

Source: MLIST
Type: UNKNOWN
[oss-security] 20081105 CVE id request: vlc

Source: MLIST
Type: UNKNOWN
[oss-security] 20081110 Re: CVE id request: vlc

Source: CCN
Type: OSVDB ID: 49808
VLC Media Player CUE Demuxer Image File Handling Overflow

Source: CCN
Type: OSVDB ID: 49809
VLC Media Player RealText Demuxer Subtitle File Handling Overflow

Source: BUGTRAQ
Type: UNKNOWN
20081106 [TKADV2008-012] VLC media player cue Processing Stack Overflow Vulnerability

Source: BID
Type: UNKNOWN
32125

Source: CCN
Type: BID-32125
VLC Media Player Multiple Stack Based Buffer Overflow Vulnerabilities

Source: CCN
Type: Trapkit Security Advisory TKADV2008-012
VLC media player cue Processing Stack Overflow Vulnerability

Source: MISC
Type: Exploit
http://www.trapkit.de/advisories/TKADV2008-012.txt

Source: CCN
Type: VideoLAN-SA-0810
Buffer overflows in VLC RealText and CUE demuxers

Source: CONFIRM
Type: Vendor Advisory
http://www.videolan.org/security/sa0810.html

Source: XF
Type: UNKNOWN
vlcmediaplayer-cue-bo(46375)

Source: XF
Type: UNKNOWN
vlcmediaplayer-cue-bo(46375)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:14798

Vulnerable Configuration:

Configuration 1:

cpe:/a:videolan:vlc_media_player:0.5.0:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.5.3:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.6.0:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.6.2:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.7.0:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.7.1:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.7.1a:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.7.2:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.7.2:test2:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.7.2:test3:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.8.0:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.8.1:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.8.2:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.8.4:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.8.4:test2:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.8.4a:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.8.5:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.8.5:test3:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.8.5:test4:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.8.6:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.8.6a:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.8.6b:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.8.6c:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.8.6d:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.8.6e:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.8.6f:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.8.6g:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.8.6h:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.8.6i:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.9:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.9.0:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.9.1:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.9.2:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.9.3:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.9.4:*:*:*:*:*:*:*

OR cpe:/a:videolan:vlc_media_player:0.9.5:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:videolan:vlc_media_player:0.8.6:*:*:*:*:*:*:*