Vulnerability Name:

CVE-2010-3124 (CCN-63777)

Assigned:2010-08-23
Published:2010-08-23
Updated:2017-09-19
Summary:Untrusted search path vulnerability in bin/winvlc.c in VLC Media Player 1.1.3 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse wintab32.dll that is located in the same folder as a .mp3 file.
Per: http://cwe.mitre.org/data/definitions/426.html

'CWE-426: Untrusted Search Path'
CVSS v3 Severity:10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
8.0 High (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:POC/RL:W/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
9.3 High (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
8.0 High (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:POC/RL:W/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2010-3124

Source: CONFIRM
Type: Patch
http://git.videolan.org/?p=vlc/vlc-1.1.git;a=blobdiff;f=bin/winvlc.c;h=ac9b97ca9f5f9ba001f13bf61eb5127a1c1dbcbf;hp=2d09cba320e3b0def7069ce1ebab25d1340161c5;hb=43a31df56c37bd62c691cdbe3c1f11babd164b56;hpb=2d366da738b19f8d761d7084746c6db6f52808c6

Source: CCN
Type: SA41107
VLC Media Player Insecure Library Loading Vulnerability

Source: SECUNIA
Type: Vendor Advisory
41107

Source: EXPLOIT-DB
Type: Exploit
14750

Source: CCN
Type: Microsoft Security Advisory (2269637)
Insecure Library Loading Could Allow Remote Code Execution

Source: MLIST
Type: UNKNOWN
[oss-security] 20100825 Re: CVE request: VLC media player - DLL preloading vulnerability

Source: MLIST
Type: Patch
[oss-security] 20100825 CVE request: VLC media player - DLL preloading vulnerability

Source: CCN
Type: OSVDB ID: 67492
VLC Media Player Path Subversion Arbitrary DLL Injection Code Execution

Source: CCN
Type: BID-42707
VLC Media Player 'wintab32.dll' DLL Loading Arbitrary Code Execution Vulnerability

Source: CCN
Type: VideoLAN Web site
VideoLAN: Free Multimedia Solutions

Source: VUPEN
Type: Vendor Advisory
ADV-2010-2172

Source: XF
Type: UNKNOWN
vlcmediaplayer-dll-ce(63777)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:12190

Source: EXPLOIT-DB
Type: EXPLOIT
Offensive Security Exploit Database

Source: EXPLOIT-DB
Type: EXPLOIT
EDB-ID: 14750

Vulnerable Configuration:Configuration 1:
  • cpe:/a:videolan:vlc_media_player:0.1.99b:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.1.99e:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.1.99f:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.1.99g:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.1.99h:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.1.99i:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.2.60:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.2.61:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.2.62:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.2.63:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.2.70:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.2.71:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.2.72:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.2.73:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.2.80:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.2.81:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.2.82:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.2.83:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.2.90:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.2.91:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.2.92:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.3.0:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.3.1:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.4.0:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.4.1:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.4.2:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.4.3:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.4.4:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.4.5:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.4.6:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.5.0:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.5.2:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.5.3:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.6.0:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.6.1:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.6.2:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.7.0:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.7.2:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.8.0:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.8.1:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.8.2:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.8.4:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.8.5:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.8.6:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.9.2:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.9.3:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.9.4:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.9.5:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.9.6:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.9.8a:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.9.9:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.9.10:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:1.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:1.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:1.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:1.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:1.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:1.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:1.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:1.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:*:*:*:*:*:*:*:* (Version <= 1.1.3)

  • Configuration CCN 1:
  • cpe:/a:videolan:vlc_media_player:0.8.6:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.1.99b:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.1.99e:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.1.99f:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.1.99g:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.1.99h:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.1.99i:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.2.60:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.2.61:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.2.62:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.2.63:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.2.70:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.2.71:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.2.72:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.2.73:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.2.80:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.2.81:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.2.82:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.2.83:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.2.90:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.2.91:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.2.92:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.3.0:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.3.1:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.4.0:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.4.1:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.4.2:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.4.3:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.4.4:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.4.5:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.4.6:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.5.0:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.5.2:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.5.3:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.6.0:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.6.1:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.6.2:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.7.0:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.7.2:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.8.0:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.8.1:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.8.2:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.8.4:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.8.5:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.9.2:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.9.4:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.9.3:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.9.5:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.9.6:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.9.9:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:1.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:1.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.9.10:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:0.9.8a:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:1.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:1.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:1.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:1.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:1.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:1.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:videolan:vlc_media_player:1.0.4:*:*:*:*:*:*:*

  • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:12190
    V
    Untrusted search path vulnerability in bin/winvlc.c in VLC Media Player 1.1.3 and earlier allows DLL hijacking attacks
    2012-11-19
    BACK
    videolan vlc media player 0.1.99b
    videolan vlc media player 0.1.99e
    videolan vlc media player 0.1.99f
    videolan vlc media player 0.1.99g
    videolan vlc media player 0.1.99h
    videolan vlc media player 0.1.99i
    videolan vlc media player 0.2.0
    videolan vlc media player 0.2.60
    videolan vlc media player 0.2.61
    videolan vlc media player 0.2.62
    videolan vlc media player 0.2.63
    videolan vlc media player 0.2.70
    videolan vlc media player 0.2.71
    videolan vlc media player 0.2.72
    videolan vlc media player 0.2.73
    videolan vlc media player 0.2.80
    videolan vlc media player 0.2.81
    videolan vlc media player 0.2.82
    videolan vlc media player 0.2.83
    videolan vlc media player 0.2.90
    videolan vlc media player 0.2.91
    videolan vlc media player 0.2.92
    videolan vlc media player 0.3.0
    videolan vlc media player 0.3.1
    videolan vlc media player 0.4.0
    videolan vlc media player 0.4.1
    videolan vlc media player 0.4.2
    videolan vlc media player 0.4.3
    videolan vlc media player 0.4.4
    videolan vlc media player 0.4.5
    videolan vlc media player 0.4.6
    videolan vlc media player 0.5.0
    videolan vlc media player 0.5.1
    videolan vlc media player 0.5.2
    videolan vlc media player 0.5.3
    videolan vlc media player 0.6.0
    videolan vlc media player 0.6.1
    videolan vlc media player 0.6.2
    videolan vlc media player 0.7.0
    videolan vlc media player 0.7.2
    videolan vlc media player 0.8.0
    videolan vlc media player 0.8.1
    videolan vlc media player 0.8.2
    videolan vlc media player 0.8.4
    videolan vlc media player 0.8.5
    videolan vlc media player 0.8.6
    videolan vlc media player 0.9.2
    videolan vlc media player 0.9.3
    videolan vlc media player 0.9.4
    videolan vlc media player 0.9.5
    videolan vlc media player 0.9.6
    videolan vlc media player 0.9.8a
    videolan vlc media player 0.9.9
    videolan vlc media player 0.9.10
    videolan vlc media player 1.0.0
    videolan vlc media player 1.0.1
    videolan vlc media player 1.0.2
    videolan vlc media player 1.0.3
    videolan vlc media player 1.0.4
    videolan vlc media player 1.0.5
    videolan vlc media player 1.0.6
    videolan vlc media player 1.1.0
    videolan vlc media player 1.1.1
    videolan vlc media player 1.1.2
    videolan vlc media player *
    videolan vlc media player 0.8.6
    videolan vlc media player 0.1.99b
    videolan vlc media player 0.1.99e
    videolan vlc media player 0.1.99f
    videolan vlc media player 0.1.99g
    videolan vlc media player 0.1.99h
    videolan vlc media player 0.1.99i
    videolan vlc media player 0.2.0
    videolan vlc media player 0.2.60
    videolan vlc media player 0.2.61
    videolan vlc media player 0.2.62
    videolan vlc media player 0.2.63
    videolan vlc media player 0.2.70
    videolan vlc media player 0.2.71
    videolan vlc media player 0.2.72
    videolan vlc media player 0.2.73
    videolan vlc media player 0.2.80
    videolan vlc media player 0.2.81
    videolan vlc media player 0.2.82
    videolan vlc media player 0.2.83
    videolan vlc media player 0.2.90
    videolan vlc media player 0.2.91
    videolan vlc media player 0.2.92
    videolan vlc media player 0.3.0
    videolan vlc media player 0.3.1
    videolan vlc media player 0.4.0
    videolan vlc media player 0.4.1
    videolan vlc media player 0.4.2
    videolan vlc media player 0.4.3
    videolan vlc media player 0.4.4
    videolan vlc media player 0.4.5
    videolan vlc media player 0.4.6
    videolan vlc media player 0.5.0
    videolan vlc media player 0.5.1
    videolan vlc media player 0.5.2
    videolan vlc media player 0.5.3
    videolan vlc media player 0.6.0
    videolan vlc media player 0.6.1
    videolan vlc media player 0.6.2
    videolan vlc media player 0.7.0
    videolan vlc media player 0.7.2
    videolan vlc media player 0.8.0
    videolan vlc media player 0.8.1
    videolan vlc media player 0.8.2
    videolan vlc media player 0.8.4
    videolan vlc media player 0.8.5
    videolan vlc media player 0.9.2
    videolan vlc media player 0.9.4
    videolan vlc media player 0.9.3
    videolan vlc media player 0.9.5
    videolan vlc media player 0.9.6
    videolan vlc media player 0.9.9
    videolan vlc media player 1.0.0
    videolan vlc media player 1.0.1
    videolan vlc media player 1.0.3
    videolan vlc media player 0.9.10
    videolan vlc media player 0.9.8a
    videolan vlc media player 1.0.2
    videolan vlc media player 1.0.5
    videolan vlc media player 1.0.6
    videolan vlc media player 1.1.3
    videolan vlc media player 1.1.2
    videolan vlc media player 1.1.1
    videolan vlc media player 1.1.0
    videolan vlc media player 1.0.4