Beware! Playing Untrusted Videos On VLC Player Could Hack Your Computer

Doing so could allow hackers to remotely take full control over
your computer system.

That’s because VLC media player software versions prior to 3.0.7
contain two high-risk security
vulnerabilities, besides many other medium- and low-severity
security flaws, that could potentially lead to arbitrary code
execution attacks.
^[1]

With more than 3 billion downloads, VLC is a hugely popular
open-source media player software that is currently being used by
hundreds of millions of users worldwide on all major platforms,
including Windows, macOS, Linux, as well as Android and iOS mobile
platforms.

Discovered by Symeon Paraschoudis from Pen Test Partners and
identified as CVE-2019-12874^[2], the first high-severity
vulnerability is a double-free issue which resides in
“zlib_decompress_extra” function of VideoLAN VLC player and gets
triggered when it parses a malformed MKV file type within the
Matroska demuxer.

The second high-risk flaw, identified as CVE-2019-5439^[3]
and discovered by another researcher, is a read-buffer overflow
issue that resides in “ReadFrame” function and can be triggered
using a malformed AVI video file.

Though the proof-of-concepts demonstrated by both researchers
cause a crash, a potential attacker can exploit these
vulnerabilities to achieve arbitrary code execution with the same
privileges as of the target user on the system.

All the attacker needs to do is craft a malicious MKV or AVI
video file and trick users into playing it using the vulnerable
versions of VLC.

Well, that’s not a tough job, as attackers can easily target
hundreds of thousands of users within hours by simply releasing
malicious video files on torrent sites, mimicking as a pirated copy
of a newly released movie or TV series.

According to an advisory released by VideoLAN, having ASLR and
DEP protections enabled on the system could help users mitigate the
threat, but developers did admit that these protections could be
bypassed too.

Paraschoudis used honggfuzz fuzzing tool to discover this issue
and four other bugs, which were also patched by the VideoLAN team
earlier this month along with 28 other bugs reported by other
security researchers through EU-FOSSA bug bounty program.

Users are highly recommended to update their media player
software to VLC 3.0.7 or later versions and should avoid opening or
playing video files from untrusted third parties.