Update Protection against VideoLAN VLC ActiveX Control Memory Corruption Vulnerability
| Check Point Reference: | CPAI-2008-009 | |
| Date Published: | ||
| Severity: | ||
| Source: | Secunia Advisory: SA27878 | |
| Industry Reference(s): | CVE-2007-6262 | |
| Protection Provided by: |
VPN-1
|
|
| Who is Vulnerable? VideoLAN VLC 0.86 VideoLAN VLC 0.86a VideoLAN VLC 0.86b VideoLAN VLC 0.86c | ||
| Vulnerability Description A memory corruption vulnerability was reported in VideoLAN VLC media player. VLC media player is a free multimedia player for various audio and video formats as well as DVDs, VCDs, and various streaming protocols. By convincing a user to visit a specially crafted web page, a remote attacker may trigger this vulnerability to execute arbitrary code on an affected system. |
||
|
Update/Patch Available Update to version 0.8.6d. VLC |
|
|
Vulnerability Details This vulnerability is due to recursive object release as a result from flaws in the VideoLAN VLC ActiveX Control. To trigger this issue, an attacker may create a malicious web page that will exploit these flaws. Successful exploitation may allow execution of arbitrary code on the vulnerable system. |
Protection Overview
By enabling this protection, SmartDefense will detect and block the vulnerable ActiveX Control. Depending on the traffic mix, activating this protection may result in performance degradation.
In order for the protection to be activated, update your VPN-1/InterSpect product to the latest SmartDefense update. For information on how to update SmartDefense, go to SBP-2006-05, Protection tab and select the version of your choice.
To configure the defense, select your product from the list below and follow the related protection steps.