Home > Cyber News > CVE-2018-4013: MPlayer and VLC Both Affected by a Critical Vulnerability
CYBER NEWS

CVE-2018-4013: MPlayer and VLC Both Affected by a Critical Vulnerability

A security researcher has announced the discovery of a critical vulnerability in two of the most popular media players — MPlayer and VLC. The issue was found in the LIVE555 media streaming library which is used in both applications and tracked in the CVE-2018-4013 advisory.




CVE-2018-4013: VLC and MPlayer Vulnerability Caused by Live555 Media Streaming Library

The two popular media players VLC and MPlayer were found to be affected by the same vulnerability. This was reported by a security researcher that found that the root of the cause is the LIVE555 media streaming library which they both use. It is maintained by the Live Networks company and serves to provide compatibility with RTP and SIP protocols and processing various audio and video formats. Without it VLC and MPlayer will not be able to play streaming media which is one of their most important features.

Related Story: [wplinkpreview url=”https://sensorstechforum.com/kodi-media-player-installations-used-distributing-malware/”]Kodi Media Player Installations Used for Distributing Malware

The CVE-2018-4013 advisory has been assigned to the vulnerability, it indicates that unpatched versions of the software allows millions of users worldwide to become possible victims of hacker attacks. The reason for this is the way HTTP requests are made. Hackers can craft a special packet causing a stack-based buffer overflow which can be used for code execution. The full description of the CVE-2018-4013 advisory reads the following:

An exploitable code execution vulnerability exists in the HTTP packet-parsing functionality of the LIVE555 RTSP server library version 0.92. A specially crafted packet can cause a stack-based buffer overflow, resulting in code execution. An attacker can send a packet to trigger this vulnerability.

These two programs are among the most commonly installed third-party software by end users and this is the reason why such problems are automatically classified as major impacts. However the security report does indicate that the problem does not lie within the codebase of the applications but rather components that are developed by outside sources and used for enhancing the player’s functions. In this particular case the media streaming component is essential for providing one of the core functions.

Both players have issued security updates and users are advised to apply them as soon as possible.

Avatar

Martin Beltov

Martin graduated with a degree in Publishing from Sofia University. As a cyber security enthusiast he enjoys writing about the latest threats and mechanisms of intrusion.

More Posts

Follow Me:
Twitter

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...