16 ms·

About the “Security Issue” on VLC

405 points by tiri 7y ago

deleted 7y ago
[deleted]
LeonM 7y ago
So none of the tech news websites contacted VideoLAN and published their articles without checking their source. I believe this sums up the problem with online news: being first matters most to news sites. It drives traffic. Accurate reporting comes second. I feel bad for VideoLAN, according to them the bug was in a 3rd party lib and was fixed 16 months ago.
- Maxious 7y ago
  https://news.softpedia.com/news/critical-flaw-in-vlc-media-player-discovered-by-german-cybersecurity-agency-526768.shtml https://news.softpedia.com/news/critical-flaw-in-vlc-media-p... sources https://winfuture.de/news,110171.html https://winfuture.de/news,110171.html sources https://www.cert-bund.de/advisoryshort/CB-K19-0634 https://www.cert-bund.de/advisoryshort/CB-K19-0634 sources https://nvd.nist.gov/vuln/detail/CVE-2019-13615 https://nvd.nist.gov/vuln/detail/CVE-2019-13615 which finally gets to the bug report https://trac.videolan.org/vlc/ticket/22474 https://trac.videolan.org/vlc/ticket/22474 To boot https://www.securityfocus.com/bid/109304 https://www.securityfocus.com/bid/109304 claims all versions are vulnerable and the vendor reported it
  - jbk 7y ago
    > To boot https://www.securityfocus.com/bid/109304 https://www.securityfocus.com/bid/109304 claims all versions are vulnerable and the vendor reported it Of course, we never reported such a thing: a security issue in a 3rd party library, fixed more than 16months ago. And VLC binaries were updated 16months ago too... The issue is that MITRE is not doing its job when assigning the CVE or even checking the validity of the claim. But they refuse to talk to us. Why?
    - dsfyu404ed 7y ago
      >But they refuse to talk to us. Why? Because stonewalling is SOP for government bureaucracies when they screw up. When you're the government the various systems the people you screwed have for recourse work slightly differently so stonewalling works better than spewing out a ton of deny and distract PR like corporations do.
      - majewsky 7y ago
        > Because stonewalling is SOP for big orgs when they screw up. FTFY A lot of people seem to be under the impression that when you just privatize a government agency, it magically becomes better. It doesn't.
  - tastroder 7y ago
    I really wonder where the CVE got their "attack vector: network" and CERT "remote: yes" classifications from. Even on vulnerable systems this seems to have been a local issue (or do they do that for anything that might potentially pull malicious files from outside sources? Sounds kind of backwards.)
    - jbk 7y ago
      > I really wonder where the CVE got their "attack vector: network" and CERT "remote: yes" classifications from. They always do that with VLC: even file can be on a playlist, and a playlist can be sent by email or over the web, with a link... So they classify all VLC bugs with network and remote.
      - virgilp 7y ago
        By that token, is there ANY application where the attack vector is not 'network' and 'remote' is 'no'? Because I fail to think of any minimally-useful app that doesn't open external files.
        jbk 7y ago
        Because we support playlists. I know it does make sense, but Mitre is never answering.
        throwaway_391 7y ago
        CVSS is an insane rating system made for a simpler time by antiquated practices which doesn't account for many factors either well if at all. Hover your mouse over each button https://www.first.org/cvss/calculator/3.0 https://www.first.org/cvss/calculator/3.0 . There's Attack complexity 'low' and 'high', for instance. You're either a script kiddie or have a two billion dollar exploitation budget and all the human resources you need, but nothing in between.
        wademealing 7y ago
        I will wear my vendor hat here for a moment, AC not about the attacker, but the configuration of the component being assessed.
- larrysalibra 7y ago
  News articles not checking sources is pretty standard. A few years ago I had a blog post about something regarding Apple picked up by the Hong Kong Free Press and then the New York Times. It ended up resulting in articles across hundreds of publications. The only publications that talked to me and Apple were the New York Times, the original Hong Kong Free Press and a CNN money reporter. Everyone else was just rewriting other posts. The economics of the industry drive this behavior - most reporters have a quota of stories they have to write per day and there's no time or budget to even email sources let alone sit around waiting for a reply. If you want to read more about this, I recommend the book "Trust me, I'm lying" by Ryan Holiday.
  - nemosaltat 7y ago
    Excellent book. I particularly like his thoughts on the “link economy”- how links give credence to statements in an article despite the fact that they may not even link to a relevant or accurate source. That said, I “read” a lot of of audiobooks and this one is self-narrated. I highly recommend the book, but don’t recommend Ryan Holiday as a narrator.
    - fernandotakai 7y ago
      i've found that trust me i'm lying was horribly recorded (at least on audible) --i tried listening to it twice, and just couldn't. i also tried listening to conspiracy, also by him, and it was much more enjoyable (he narrates, but the sound quality is much better).
- npiht 7y ago
  I expect a little bit of personal responsibility at this point. You simply should not believe what you read in the news. It's either not researched at all or just false.
- jbk 7y ago
  > So none of the tech news websites contacted VideoLAN and published their articles without checking their source. Actually, one did: numerama. That's all. > I feel bad for VideoLAN, according to them the bug was in a 3rd party lib and was fixed 16 months ago. My night and morning have been difficult, as you can imagine...
  - JosephRedfern 7y ago
    I'm sorry that you're having a bad couple of days thanks to shitty journalism. Thank you for your efforts in developing VLC, it is a great tool.
  - wademealing 7y ago
    I wrote to NIST/NVD tis morning about the CVSS score (12+ hours ago now) they haven't got back to me.
  - madez 7y ago
    Thank you for your contributions on VLC. It shines bad light on the official institutions that they haven't checked back with you.
  - simonebrunozzi 7y ago
    It will sound boring quickly, but I also want to thank you for developing VLC. Great work. Amazing work. You have many devoted fans all around the world.
  - chachachoney 7y ago
    Off topic, but... I've used VLC on all supported platforms for almost as long as it's been in existence: THANK YOU.
  - BasicObject 7y ago
    I wanted to thank you for your work on VLC as well. It has been my go to video player for many years.
  - meowface 7y ago
    We all love VLC and know the hard work you put into it, and into keeping it secure. Don't stress too much. The media buzz will die down soon.
- Zenst 7y ago
  If VLC was a commercial product, this would be a lawyer time for effectively damaging reputation based upon lies and would see many media outlet dragged over the coals. VLC is not a commercial product, but equally still took the same impact from this and as we know, many end-user will be oblivious of any retraction as the case with many media retractions/corrections that get buried and do not traction. Maybe we need Open Lawyer as well as Open Source! I'm of the thinking that the only way media would get any education would be litigation. Sad I know, but that is the World they operate in. Why else do media outlets have lawyer departments.
  - pbhjpbhj 7y ago
    [Edit, see below.]
    - jbk 7y ago
      VLC is open source, distributed by VideoLAN non-profit and is totally non-commercial. The only money received by the non-profit is through donations.
      - pbhjpbhj 7y ago
        I didn't express that well: In copyright terms, if you compete with commercial; or acquire money via a side-channel then it's "commercial" ... what I was trying to express was that it occupies a space where it's serious software and that damage to it's reputation should be treated just as seriously as damage to a sold product from a for-profit. Apologies.
      - Zenst 7y ago
        Yes, hence they don't have a lawyer ontap, which was kinda the point I was making. The education (what I'm going to call it) that they could bestow upon these bismershing media outlets, would fund much Open Source work for VLC.
        dvtrn 7y ago
        You say “they don’t have a lawyer” I don’t know if you realize you’re addressing the lead developer and president of VLC. I think he may be quite a bit more aware of his org’s ability and desire to retain legal counsel than all of us.
- lucideer 7y ago
  This is worse though. Neither MITRECorp, CERT-Bund.de nor NIST are tech news websites or journalistic publications. This is beyond being an issue with online news: this is an issue with security organisations actively ignoring their own policies due—seemingly—to an institutional disregard for a non-commercial FOSS project.
- rkagerer 7y ago
  Suggest everyone here pick a couple of news agencies who propagated this crap and write to the editors admonishing their shoddy fact-checking. I emailed two this morning.
- nvr219 7y ago
  > I believe this sums up the problem with online news: being first matters most to news sites. It drives traffic. Accurate reporting comes second. This problem has been around as long as more than one news outlet has been around... Getting the story first over getting the story right didn't get invented by online news.
seapunk 7y ago
Compiled here: https://threader.app/thread/1153963312981389312 https://threader.app/thread/1153963312981389312
deleted 7y ago
[deleted]
paddlepop 7y ago
MITREs response to this is a perfect example of the old-school security team mindset. If I had a nickel for every security team I've worked with that a) treat reporting as gospel and don't validate it, and b) don't talk to the developer. From my experience the key issue is they don't understand the issue enough to engage in a meaningful discussion with the developer
- jbk 7y ago
  But the biggest issue is that they refuse that we become the CNA for VLC bugs. So, they are the root CNA for VLC bugs, and they don't triage them correctly. And don't update the issues when we mention them.
  - nbabitskiy 7y ago
    Why can't you be an authority of your CVEs without consulting an American gov agency? I'm sure, VLC org is way more trustworthy for nine out of ten people on the Earth.
    - jbk 7y ago
      Because everyone uses CVE. And then, it gets in the press...
  - viraptor 7y ago
    Not allowing CNA seems to be the biggest issue. Long time ago we had issues where getting a new cve for an open source project was really rare and hard to achieve. Now anyone who asks gets one without validation. Two extremes, likely due to lack of resources, but they won't share the load...
- lol768 7y ago
  > treat reporting as gospel and don't validate Indeed, and they've been doing the same thing with projects like jackson-databind. 10s of completely meaningless CVEs issued for each new deserialization gadget that someone finds and gets added to a blacklist designed to protect a known-unsafe use-case (deserializing user input whilst defaultTyping is enabled). It causes a huge waste of resources on the blue side.
codewithcheese 7y ago
> The reporter is using Ubuntu 18.04, which is an old version of Ubuntu, and clearly has not all the updated libraries. It's not a "old" version of Ubuntu its the latest LTS.
- M2Ys4U 7y ago
  LTS == old. That's the point of LTS.
  - remedan 7y ago
    The point of LTS is that it's old but still receiving security fixes.
  - nguoi 7y ago
    18.04 == 15 months old.
- pgeorgi 7y ago
  Just that Ubuntu apparently forgot about the "S" part of "LTS", or they could have updated that package. Alternatively (because libebml is "universe", that is, unsupported), stop ripping out maintained components from projects to "use system packages instead" which are not maintained. It's stuff like this that makes Firefox and Pale Moon play hardball with distros that mess up their software. (nevermind that the Pale Moon devs aren't even trying to solve such things amicably)
  - Mathnerd314 7y ago
    The actual packages are from Debian, and Debian keeps them updated. Debian stretch (2017) is vulnerable, buster is not. Ubuntu 18.04 LTS is based on buster (https://askubuntu.com/questions/445487/what-debian-version-are-the-different-ubuntu-versions-based-on https://askubuntu.com/questions/445487/what-debian-version-a...) so compatibility isn't the problem. Judging from bugs like https://bugs.launchpad.net/ubuntu/+source/libebml/+bug/1412054 https://bugs.launchpad.net/ubuntu/+source/libebml/+bug/14120... the problem is just that nobody at Ubuntu is responsible for keeping it updated in LTS releases. tl;dr Avoid Ubuntu LTS because they don't maintain their packages properly.
onli 7y ago
I don't like the exchange with TheRegister: > TheRegister: FWIW we reported the VLC developers were skeptical. Happy to update our coverage accordingly. > Tho, FWIW, the PoC .MP4 seg-faulted our 3.0.7 VLC installation. > VideoLAN: using a linux distribution? with an old libebml? > TheRegister: Using Debian 9.9, using libebml4v5 1.3.4-1 > VideoLAN: Yes, so your issue is your distribution is not up-to-date, not VLC. No, the issue is that a lib VLC uses is not up-to-date, and it just happens that VLC be installed on a distribution, as is normal. It can't run on bare metal. If I understand https://tracker.debian.org/pkg/libebml https://tracker.debian.org/pkg/libebml correctly it is possible the issue here is that oldstable Debian did not receive a (security?) update for libebml. But this still affects the users of the program. It's still something that could be justified to notify users about. But I understand the frustration about not being contacted, and I understand the project does not want to be seen as responsible for this if the fault lies with Debian. And it's absolutely possible the CVE on VLC are wrong, I remember being surprised a few times about their strange severity. But still. I don't like this blame shifting. If users do not run a unsupported distribution it is not completely unreasonable to assume his falls into the security sphere of the main project, VLC.
- jbk 7y ago
  An issue on one or two Linux distribution for a OOB-read crash is very very different from "VLC vulnerable on all machines, uninstall now!" Especially, since the very very large majority of VLC users are not on Linux, but using binaries.
  - onli 7y ago
    I agree. Main issue seems reasonable. Still, the environment that VLC lives in includes Debian oldstable, and this exchange feels to me like not hitting the right balance between accepting that and moving the justified blame to the distro. The reporter was not unreasonable after all. > Especially, since the very very large majority of VLC users are not on Linux, but using binaries. It's also apart from BSD pretty much the only OS where security issues like this matter, since closed source OS like Windows are insecure by default. I'm aware this is an ideological standpoint and not universally accepted.
hs86 7y ago
libebml is in the Ubuntu universe repository which means that it is not supported by Canonical. And in the Debian changelog for this package I don't see any mentions of a security issue that was fixed 16 months ago: https://metadata.ftp-master.debian.org/changelogs//main/libe/libebml/libebml_1.3.9-2_changelog https://metadata.ftp-master.debian.org/changelogs//main/libe... I am loosing more and more confidence that these "package the world and freeze everything in place" distros are the right choice for end users.
- yrro 7y ago
  FYI given a CVE or package name, you can view the state of a particular issue across all Debian versions using the Security Bug Tracker. For instance https://security-tracker.debian.org/tracker/CVE-2019-13615 https://security-tracker.debian.org/tracker/CVE-2019-13615 In this case, this hasn't yet been updated with the info from the VLC team, I expect it'll be marked ignore or not-vulnerable once that happens. I don't know the real CVE for the libebml issue but it doesn't appear to be listed at https://security-tracker.debian.org/tracker/source-package/libebml https://security-tracker.debian.org/tracker/source-package/l... which means that the Debian security team aren't aware of it.
- thegeomaster 7y ago
  > I am loosing more and more confidence that these "package the world and freeze everything in place" distros are the right choice for end users. I'm there with you. I use a rolling distro (Arch) and I update all packages to the latest versions whenever I'm bored. I do this because I can't remember the last time something broke this way. I've been doing that for ~6 years on 3 different machines. On the other hand, a lot of my friends use Ubuntu as their main OS and they constantly have mysterious issues with software, trouble installing stuff (a ton of things require binary-only vendor-run PPAs which then often have out-of-date versions), etc. So I'm wondering, at least for desktop use-cases, what exactly is gained there? I would've thought that freezing all packages and issuing a release would allow a much more rigorous QA process and make the system rock solid. But somehow a huge company (Canonical) cannot make a system that is as stable as orders of magnitude less popular, volunteer-run rolling distribution. Something just doesn't add up to me there. It could be a bias of my sample, or Canonical just not caring much about the desktop experience anymore. (I run a lot of machines on Ubuntu LTS and for the server-side it's pretty good.)
fulafel 7y ago
I think the VLC developers come off as pretty defensive in this. They flame the reporter for opening the issue on the issue tracker, but on the issue the reporter says that he got no response from the VLC security contact which he tried first. Then, they dismiss the vulnerability and flame the CVE assigners, because VLC themselves are shipping a distribution with the vuln fixed, even though many Linux distributions and presumably other distributors of VLC remain vunerable - a situation clearly requireing vulnerability coordination and a CVE assignment.
- jbk 7y ago
  Absolutely not: - the reporter never contacted us, we have a clear process and a bounty program. We checked again, he never did. - we receive and process all security issues privately: we fixed 31 of them in the last update. And miracly, the other reporters managed to contact us. - Linux is the smallest OS for VLC. - An issue on one or two Linux distribution for a OOB-read crash is very very different from "VLC vulnerable on all machines, uninstall now!" - The CVE number of 9.8 makes no sense. How do you even exploit this crash? - VLC has DEP and ASLR activated everywhere. How do you execute code with this read issue?
  - pgeorgi 7y ago
    Since this is tarnishing your brand, maybe ask Ubuntu to cease shipping "VLC" if they do such a half-assed job (enough effort to replace integrated libraries with system packages, not enough effort to maintain those packages)?
    - tgragnato 7y ago
      > maybe ask Ubuntu to cease shipping "VLC" I want applications to be packaged by my distribution. Updates are up to maintainers (dependencies included), as it has always been. If MITRE wants to assign a CVE, warning people that they need an updated lib, that's fine. The issue is the trustworthy and handling of CVEs (... plus reporters).
      - 7y ago
throwaway_391 7y ago
Slightly offtopic, but are vulns related to overflows no longer pocced publicly or are there mitigating factors which make exploitation impossible (eg K/ASLR etc)? The specific CVE listings I'm referring to are: https://www.cvedetails.com/vulnerability-list/vendor_id-5842/product_id-9978/Videolan-Vlc-Media-Player.html https://www.cvedetails.com/vulnerability-list/vendor_id-5842... https://www.cvedetails.com/vulnerability-list/vendor_id-26/product_id-32238/Microsoft-Windows-10.html https://www.cvedetails.com/vulnerability-list/vendor_id-26/p...
- wepple 7y ago
  Building a PoC to prove you can get reliable code execution is typically 10x harder than finding an issue and patching it. The modern approach is to assume that most types of memory corruption could be exploitable, and just patch. Especially given that an inability for one person to reliably PoC does not mean it’s not exploitable; as soon as you say it’s not exploitable, Mark Dowd shows up and exploits the bug.
glandium 7y ago
Except if I missed something in my quick research, there doesn't seem to have been a CVE for libebml when it was fixed 16 months ago. So it's really not surprising that LTS distros don't have the fix...
- middleload 7y ago
  LTS depends on CVEs. And we see here that the CVE database is not entirely trust worthy. The chain is a bit broken.
  - madez 7y ago
    But the press and slow moving organizations love it.
yrro 7y ago
What's the CVE for the actual security issue in libebml? ... I guess there isn't one. According to VLC upstream it was fixed in libevml 1.3.6. https://trac.videolan.org/vlc/ticket/22474#comment:21 https://trac.videolan.org/vlc/ticket/22474#comment:21
wrongGLIBC 7y ago
This is why I stopped using Linux. Fuck dependency hell.
jokowueu 7y ago
>Yes, so your issue is your distribution is not up-to-date, not VLC. I've always found it odd that many of the packages on certain linux distributions were old . Like how one time the latest openvpn version on the latest Ubuntu release was a year old.
- plopz 7y ago
  Debian 8 is still on php 5.6 which is EOL, even if you upgrade to debian 9 you would be on php 7.0 which is also EOL.
  - apocalyptic0n3 7y ago
    Debian 10 is running 7.3, thankfully. But their LTS runs for 5 years and 7.3 will be EOL about 7 months before Buster and active support dropped about 17 months before. And PHP 7.4 is due out in November/December. So Buster will be outdated with its PHP release 6 months after release.
sleepysysadmin 7y ago
Delete
- stronglikedan 7y ago
  > Is the fix lawyers suing them all for libel/slander? IMHO, it's definitely time for this to be allowed.
p49k 7y ago
Gizmodo posts the headline on their front page, "You Might Want to Uninstall VLC. Immediately" Following the debunking of the story, what does Gizmodo do? Leave it on the front page and change the headline to "You Might Want to Uninstall VLC. Immediately [Updated]"
- GunniH 7y ago
  They actually did. >You Might Want to Uninstall VLC. Immediately. [Updated: Maybe Not] Is the current title...
  - dvtrn 7y ago
    We have reached out to both companies for more info on what happened regarding the initial CVE Should have done that from the very beginning, as should have MITRE before publishing a CVE ID. Failures all around on this one. Sorry you’re having such a shit morning, jbk, because of other people’s laziness.
  - NikolaeVarius 7y ago
    Its amazing how a title can have two entirely contradictory, non committal claims telling you to do a thing, and yet tell me absolutely nothing useful.
    - madez 7y ago
      Will you still read Gizmodo or consider it a trustable source?
      - NikolaeVarius 7y ago
        I read gizmodo every once in a while for mild entertainment. I have never considered it, or anything related to Kinja, to be trustworthy in any shape or form.
      - chachachoney 7y ago
        The Gell-Man amnesia effect is quite strong.
Aissen 7y ago
It's funny jbk did a talk at Pass the Salt this year entirely prophesying this type of event (it's not the first time this happens…): https://passthesalt.ubicast.tv/videos/vlc-and-security/ https://passthesalt.ubicast.tv/videos/vlc-and-security/ I took live notes (not nearly as colorful as the talk) here: https://anisse.astier.eu/pass-the-salt-2019-2.html https://anisse.astier.eu/pass-the-salt-2019-2.html
tptacek 7y ago
Just to clarify things: CVSS scores are almost completely meaningless and nobody should take them seriously. They're a Ouija Board that can be made to say anything.
reneberlin 7y ago
The users booting up Windose to use VLC have a much bigger problem in terms of vulerability than this reportedly false claim on the VLC-app. But - they don't know. And the newspapers will not report it in a dramatic post like this one.
carlob 7y ago
Completely OT: does anyone else find this style of posting stuff on a very long twitter thread hard to read, and somewhat worrying in terms of dependency on a proprietary platform? Why can't this be upfront on the videolan.org homepage and just linked from a single tweet?
- lysp 7y ago
  Change the twitter domain: https://twitter.com/videolan/status/1153963312981389312 https://twitter.com/videolan/status/1153963312981389312 to: https://threadreaderapp.com/videolan/status/1153963312981389312 https://threadreaderapp.com/videolan/status/1153963312981389...
  - carlob 7y ago
    I know about that, I was more interested in the political point of being beholden to a proprietary platform. I think that is especially important for one of the most widely installed open source apps (on non-geeks computers).
- whereistimbo 7y ago
  For more publicity.
  - jbk 7y ago
    This is, unfortunately, the answer. Whenever we post something, unless it is on Twitter, noone reads it.
lsferreira42 7y ago
It's on the front page of the most acessed tech blogs in Brazil too, this is a shame!
xs83 7y ago
I'm sorry but this is a shitty response from VLC: >The reporter is using Ubuntu 18.04, which is an old version of Ubuntu, and clearly has not all the updated libraries. 18.04 is an LTS version, many people (myself included) will be using this until 20.04 comes out next year! It is not old - it gets regular updates for both security and features - clearly the library for whatever reason is excluded.
- bscphil 7y ago
  They aren't blaming you for using the LTS version, and they aren't blaming Ubuntu for having an LTS version. The blame is (implicitly) on Ubuntu for not making sure the libraries their LTS version ships are up to date with the latest security patches. VLC itself isn't vulnerable - the problem is that some distributions are compiling it themselves with old libraries, which is 100% their own fault.
trilila 7y ago
gizmodo.com.au still shows "You Might Want To Uninstall VLC. Right Now. Immediately." in their title. This highlights the untrustworthiness of most "news" today, be it software, politics or business related. It's unbelievable how poorly researched articles can damage people and businesses alike. I think is this is one of the biggest pain points of today's world, and it needs solving fast.

405 points by tiri 7y ago

deleted 7y ago

[deleted]

So none of the tech news websites contacted VideoLAN and published their articles without checking their source. I believe this sums up the problem with online news: being first matters most to news sites. It drives traffic. Accurate reporting comes second. I feel bad for VideoLAN, according to them the bug was in a 3rd party lib and was fixed 16 months ago.

Maxious 7y ago
https://news.softpedia.com/news/critical-flaw-in-vlc-media-player-discovered-by-german-cybersecurity-agency-526768.shtml https://news.softpedia.com/news/critical-flaw-in-vlc-media-p... sources https://winfuture.de/news,110171.html https://winfuture.de/news,110171.html sources https://www.cert-bund.de/advisoryshort/CB-K19-0634 https://www.cert-bund.de/advisoryshort/CB-K19-0634 sources https://nvd.nist.gov/vuln/detail/CVE-2019-13615 https://nvd.nist.gov/vuln/detail/CVE-2019-13615 which finally gets to the bug report https://trac.videolan.org/vlc/ticket/22474 https://trac.videolan.org/vlc/ticket/22474 To boot https://www.securityfocus.com/bid/109304 https://www.securityfocus.com/bid/109304 claims all versions are vulnerable and the vendor reported it
- jbk 7y ago
  > To boot https://www.securityfocus.com/bid/109304 https://www.securityfocus.com/bid/109304 claims all versions are vulnerable and the vendor reported it Of course, we never reported such a thing: a security issue in a 3rd party library, fixed more than 16months ago. And VLC binaries were updated 16months ago too... The issue is that MITRE is not doing its job when assigning the CVE or even checking the validity of the claim. But they refuse to talk to us. Why?
  - dsfyu404ed 7y ago
    >But they refuse to talk to us. Why? Because stonewalling is SOP for government bureaucracies when they screw up. When you're the government the various systems the people you screwed have for recourse work slightly differently so stonewalling works better than spewing out a ton of deny and distract PR like corporations do.
    - majewsky 7y ago
      > Because stonewalling is SOP for big orgs when they screw up. FTFY A lot of people seem to be under the impression that when you just privatize a government agency, it magically becomes better. It doesn't.
- tastroder 7y ago
  I really wonder where the CVE got their "attack vector: network" and CERT "remote: yes" classifications from. Even on vulnerable systems this seems to have been a local issue (or do they do that for anything that might potentially pull malicious files from outside sources? Sounds kind of backwards.)
  - jbk 7y ago
    > I really wonder where the CVE got their "attack vector: network" and CERT "remote: yes" classifications from. They always do that with VLC: even file can be on a playlist, and a playlist can be sent by email or over the web, with a link... So they classify all VLC bugs with network and remote.
    - virgilp 7y ago
      By that token, is there ANY application where the attack vector is not 'network' and 'remote' is 'no'? Because I fail to think of any minimally-useful app that doesn't open external files.
      - jbk 7y ago
        Because we support playlists. I know it does make sense, but Mitre is never answering.
      - throwaway_391 7y ago
        CVSS is an insane rating system made for a simpler time by antiquated practices which doesn't account for many factors either well if at all. Hover your mouse over each button https://www.first.org/cvss/calculator/3.0 https://www.first.org/cvss/calculator/3.0 . There's Attack complexity 'low' and 'high', for instance. You're either a script kiddie or have a two billion dollar exploitation budget and all the human resources you need, but nothing in between.
        wademealing 7y ago
        I will wear my vendor hat here for a moment, AC not about the attacker, but the configuration of the component being assessed.
larrysalibra 7y ago
News articles not checking sources is pretty standard. A few years ago I had a blog post about something regarding Apple picked up by the Hong Kong Free Press and then the New York Times. It ended up resulting in articles across hundreds of publications. The only publications that talked to me and Apple were the New York Times, the original Hong Kong Free Press and a CNN money reporter. Everyone else was just rewriting other posts. The economics of the industry drive this behavior - most reporters have a quota of stories they have to write per day and there's no time or budget to even email sources let alone sit around waiting for a reply. If you want to read more about this, I recommend the book "Trust me, I'm lying" by Ryan Holiday.
- nemosaltat 7y ago
  Excellent book. I particularly like his thoughts on the “link economy”- how links give credence to statements in an article despite the fact that they may not even link to a relevant or accurate source. That said, I “read” a lot of of audiobooks and this one is self-narrated. I highly recommend the book, but don’t recommend Ryan Holiday as a narrator.
  - fernandotakai 7y ago
    i've found that trust me i'm lying was horribly recorded (at least on audible) --i tried listening to it twice, and just couldn't. i also tried listening to conspiracy, also by him, and it was much more enjoyable (he narrates, but the sound quality is much better).
npiht 7y ago
I expect a little bit of personal responsibility at this point. You simply should not believe what you read in the news. It's either not researched at all or just false.
jbk 7y ago
> So none of the tech news websites contacted VideoLAN and published their articles without checking their source. Actually, one did: numerama. That's all. > I feel bad for VideoLAN, according to them the bug was in a 3rd party lib and was fixed 16 months ago. My night and morning have been difficult, as you can imagine...
- JosephRedfern 7y ago
  I'm sorry that you're having a bad couple of days thanks to shitty journalism. Thank you for your efforts in developing VLC, it is a great tool.
- wademealing 7y ago
  I wrote to NIST/NVD tis morning about the CVSS score (12+ hours ago now) they haven't got back to me.
- madez 7y ago
  Thank you for your contributions on VLC. It shines bad light on the official institutions that they haven't checked back with you.
- simonebrunozzi 7y ago
  It will sound boring quickly, but I also want to thank you for developing VLC. Great work. Amazing work. You have many devoted fans all around the world.
- chachachoney 7y ago
  Off topic, but... I've used VLC on all supported platforms for almost as long as it's been in existence: THANK YOU.
- BasicObject 7y ago
  I wanted to thank you for your work on VLC as well. It has been my go to video player for many years.
- meowface 7y ago
  We all love VLC and know the hard work you put into it, and into keeping it secure. Don't stress too much. The media buzz will die down soon.
Zenst 7y ago
If VLC was a commercial product, this would be a lawyer time for effectively damaging reputation based upon lies and would see many media outlet dragged over the coals. VLC is not a commercial product, but equally still took the same impact from this and as we know, many end-user will be oblivious of any retraction as the case with many media retractions/corrections that get buried and do not traction. Maybe we need Open Lawyer as well as Open Source! I'm of the thinking that the only way media would get any education would be litigation. Sad I know, but that is the World they operate in. Why else do media outlets have lawyer departments.
- pbhjpbhj 7y ago
  [Edit, see below.]
  - jbk 7y ago
    VLC is open source, distributed by VideoLAN non-profit and is totally non-commercial. The only money received by the non-profit is through donations.
    - pbhjpbhj 7y ago
      I didn't express that well: In copyright terms, if you compete with commercial; or acquire money via a side-channel then it's "commercial" ... what I was trying to express was that it occupies a space where it's serious software and that damage to it's reputation should be treated just as seriously as damage to a sold product from a for-profit. Apologies.
    - Zenst 7y ago
      Yes, hence they don't have a lawyer ontap, which was kinda the point I was making. The education (what I'm going to call it) that they could bestow upon these bismershing media outlets, would fund much Open Source work for VLC.
      - dvtrn 7y ago
        You say “they don’t have a lawyer” I don’t know if you realize you’re addressing the lead developer and president of VLC. I think he may be quite a bit more aware of his org’s ability and desire to retain legal counsel than all of us.
lucideer 7y ago
This is worse though. Neither MITRECorp, CERT-Bund.de nor NIST are tech news websites or journalistic publications. This is beyond being an issue with online news: this is an issue with security organisations actively ignoring their own policies due—seemingly—to an institutional disregard for a non-commercial FOSS project.
rkagerer 7y ago
Suggest everyone here pick a couple of news agencies who propagated this crap and write to the editors admonishing their shoddy fact-checking. I emailed two this morning.
nvr219 7y ago
> I believe this sums up the problem with online news: being first matters most to news sites. It drives traffic. Accurate reporting comes second. This problem has been around as long as more than one news outlet has been around... Getting the story first over getting the story right didn't get invented by online news.

seapunk 7y ago

Compiled here: https://threader.app/thread/1153963312981389312 https://threader.app/thread/1153963312981389312

deleted 7y ago

[deleted]

paddlepop 7y ago

MITREs response to this is a perfect example of the old-school security team mindset. If I had a nickel for every security team I've worked with that a) treat reporting as gospel and don't validate it, and b) don't talk to the developer. From my experience the key issue is they don't understand the issue enough to engage in a meaningful discussion with the developer

jbk 7y ago
But the biggest issue is that they refuse that we become the CNA for VLC bugs. So, they are the root CNA for VLC bugs, and they don't triage them correctly. And don't update the issues when we mention them.
- nbabitskiy 7y ago
  Why can't you be an authority of your CVEs without consulting an American gov agency? I'm sure, VLC org is way more trustworthy for nine out of ten people on the Earth.
  - jbk 7y ago
    Because everyone uses CVE. And then, it gets in the press...
- viraptor 7y ago
  Not allowing CNA seems to be the biggest issue. Long time ago we had issues where getting a new cve for an open source project was really rare and hard to achieve. Now anyone who asks gets one without validation. Two extremes, likely due to lack of resources, but they won't share the load...
lol768 7y ago
> treat reporting as gospel and don't validate Indeed, and they've been doing the same thing with projects like jackson-databind. 10s of completely meaningless CVEs issued for each new deserialization gadget that someone finds and gets added to a blacklist designed to protect a known-unsafe use-case (deserializing user input whilst defaultTyping is enabled). It causes a huge waste of resources on the blue side.

codewithcheese 7y ago

> The reporter is using Ubuntu 18.04, which is an old version of Ubuntu, and clearly has not all the updated libraries. It's not a "old" version of Ubuntu its the latest LTS.

M2Ys4U 7y ago
LTS == old. That's the point of LTS.
- remedan 7y ago
  The point of LTS is that it's old but still receiving security fixes.
- nguoi 7y ago
  18.04 == 15 months old.
pgeorgi 7y ago
Just that Ubuntu apparently forgot about the "S" part of "LTS", or they could have updated that package. Alternatively (because libebml is "universe", that is, unsupported), stop ripping out maintained components from projects to "use system packages instead" which are not maintained. It's stuff like this that makes Firefox and Pale Moon play hardball with distros that mess up their software. (nevermind that the Pale Moon devs aren't even trying to solve such things amicably)
- Mathnerd314 7y ago
  The actual packages are from Debian, and Debian keeps them updated. Debian stretch (2017) is vulnerable, buster is not. Ubuntu 18.04 LTS is based on buster (https://askubuntu.com/questions/445487/what-debian-version-are-the-different-ubuntu-versions-based-on https://askubuntu.com/questions/445487/what-debian-version-a...) so compatibility isn't the problem. Judging from bugs like https://bugs.launchpad.net/ubuntu/+source/libebml/+bug/1412054 https://bugs.launchpad.net/ubuntu/+source/libebml/+bug/14120... the problem is just that nobody at Ubuntu is responsible for keeping it updated in LTS releases. tl;dr Avoid Ubuntu LTS because they don't maintain their packages properly.

onli 7y ago

I don't like the exchange with TheRegister: > TheRegister: FWIW we reported the VLC developers were skeptical. Happy to update our coverage accordingly. > Tho, FWIW, the PoC .MP4 seg-faulted our 3.0.7 VLC installation. > VideoLAN: using a linux distribution? with an old libebml? > TheRegister: Using Debian 9.9, using libebml4v5 1.3.4-1 > VideoLAN: Yes, so your issue is your distribution is not up-to-date, not VLC. No, the issue is that a lib VLC uses is not up-to-date, and it just happens that VLC be installed on a distribution, as is normal. It can't run on bare metal. If I understand https://tracker.debian.org/pkg/libebml https://tracker.debian.org/pkg/libebml correctly it is possible the issue here is that oldstable Debian did not receive a (security?) update for libebml. But this still affects the users of the program. It's still something that could be justified to notify users about. But I understand the frustration about not being contacted, and I understand the project does not want to be seen as responsible for this if the fault lies with Debian. And it's absolutely possible the CVE on VLC are wrong, I remember being surprised a few times about their strange severity. But still. I don't like this blame shifting. If users do not run a unsupported distribution it is not completely unreasonable to assume his falls into the security sphere of the main project, VLC.

jbk 7y ago
An issue on one or two Linux distribution for a OOB-read crash is very very different from "VLC vulnerable on all machines, uninstall now!" Especially, since the very very large majority of VLC users are not on Linux, but using binaries.
- onli 7y ago
  I agree. Main issue seems reasonable. Still, the environment that VLC lives in includes Debian oldstable, and this exchange feels to me like not hitting the right balance between accepting that and moving the justified blame to the distro. The reporter was not unreasonable after all. > Especially, since the very very large majority of VLC users are not on Linux, but using binaries. It's also apart from BSD pretty much the only OS where security issues like this matter, since closed source OS like Windows are insecure by default. I'm aware this is an ideological standpoint and not universally accepted.

hs86 7y ago

libebml is in the Ubuntu universe repository which means that it is not supported by Canonical. And in the Debian changelog for this package I don't see any mentions of a security issue that was fixed 16 months ago: https://metadata.ftp-master.debian.org/changelogs//main/libe/libebml/libebml_1.3.9-2_changelog https://metadata.ftp-master.debian.org/changelogs//main/libe... I am loosing more and more confidence that these "package the world and freeze everything in place" distros are the right choice for end users.

yrro 7y ago
FYI given a CVE or package name, you can view the state of a particular issue across all Debian versions using the Security Bug Tracker. For instance https://security-tracker.debian.org/tracker/CVE-2019-13615 https://security-tracker.debian.org/tracker/CVE-2019-13615 In this case, this hasn't yet been updated with the info from the VLC team, I expect it'll be marked ignore or not-vulnerable once that happens. I don't know the real CVE for the libebml issue but it doesn't appear to be listed at https://security-tracker.debian.org/tracker/source-package/libebml https://security-tracker.debian.org/tracker/source-package/l... which means that the Debian security team aren't aware of it.
thegeomaster 7y ago
> I am loosing more and more confidence that these "package the world and freeze everything in place" distros are the right choice for end users. I'm there with you. I use a rolling distro (Arch) and I update all packages to the latest versions whenever I'm bored. I do this because I can't remember the last time something broke this way. I've been doing that for ~6 years on 3 different machines. On the other hand, a lot of my friends use Ubuntu as their main OS and they constantly have mysterious issues with software, trouble installing stuff (a ton of things require binary-only vendor-run PPAs which then often have out-of-date versions), etc. So I'm wondering, at least for desktop use-cases, what exactly is gained there? I would've thought that freezing all packages and issuing a release would allow a much more rigorous QA process and make the system rock solid. But somehow a huge company (Canonical) cannot make a system that is as stable as orders of magnitude less popular, volunteer-run rolling distribution. Something just doesn't add up to me there. It could be a bias of my sample, or Canonical just not caring much about the desktop experience anymore. (I run a lot of machines on Ubuntu LTS and for the server-side it's pretty good.)

fulafel 7y ago

I think the VLC developers come off as pretty defensive in this. They flame the reporter for opening the issue on the issue tracker, but on the issue the reporter says that he got no response from the VLC security contact which he tried first. Then, they dismiss the vulnerability and flame the CVE assigners, because VLC themselves are shipping a distribution with the vuln fixed, even though many Linux distributions and presumably other distributors of VLC remain vunerable - a situation clearly requireing vulnerability coordination and a CVE assignment.

jbk 7y ago
Absolutely not: - the reporter never contacted us, we have a clear process and a bounty program. We checked again, he never did. - we receive and process all security issues privately: we fixed 31 of them in the last update. And miracly, the other reporters managed to contact us. - Linux is the smallest OS for VLC. - An issue on one or two Linux distribution for a OOB-read crash is very very different from "VLC vulnerable on all machines, uninstall now!" - The CVE number of 9.8 makes no sense. How do you even exploit this crash? - VLC has DEP and ASLR activated everywhere. How do you execute code with this read issue?
- pgeorgi 7y ago
  Since this is tarnishing your brand, maybe ask Ubuntu to cease shipping "VLC" if they do such a half-assed job (enough effort to replace integrated libraries with system packages, not enough effort to maintain those packages)?
  - tgragnato 7y ago
    > maybe ask Ubuntu to cease shipping "VLC" I want applications to be packaged by my distribution. Updates are up to maintainers (dependencies included), as it has always been. If MITRE wants to assign a CVE, warning people that they need an updated lib, that's fine. The issue is the trustworthy and handling of CVEs (... plus reporters).
    - 7y ago

throwaway_391 7y ago

Slightly offtopic, but are vulns related to overflows no longer pocced publicly or are there mitigating factors which make exploitation impossible (eg K/ASLR etc)? The specific CVE listings I'm referring to are: https://www.cvedetails.com/vulnerability-list/vendor_id-5842/product_id-9978/Videolan-Vlc-Media-Player.html https://www.cvedetails.com/vulnerability-list/vendor_id-5842... https://www.cvedetails.com/vulnerability-list/vendor_id-26/product_id-32238/Microsoft-Windows-10.html https://www.cvedetails.com/vulnerability-list/vendor_id-26/p...

wepple 7y ago
Building a PoC to prove you can get reliable code execution is typically 10x harder than finding an issue and patching it. The modern approach is to assume that most types of memory corruption could be exploitable, and just patch. Especially given that an inability for one person to reliably PoC does not mean it’s not exploitable; as soon as you say it’s not exploitable, Mark Dowd shows up and exploits the bug.

glandium 7y ago

Except if I missed something in my quick research, there doesn't seem to have been a CVE for libebml when it was fixed 16 months ago. So it's really not surprising that LTS distros don't have the fix...

middleload 7y ago
LTS depends on CVEs. And we see here that the CVE database is not entirely trust worthy. The chain is a bit broken.
- madez 7y ago
  But the press and slow moving organizations love it.

yrro 7y ago

What's the CVE for the actual security issue in libebml? ... I guess there isn't one. According to VLC upstream it was fixed in libevml 1.3.6. https://trac.videolan.org/vlc/ticket/22474#comment:21 https://trac.videolan.org/vlc/ticket/22474#comment:21

wrongGLIBC 7y ago

This is why I stopped using Linux. Fuck dependency hell.

jokowueu 7y ago

>Yes, so your issue is your distribution is not up-to-date, not VLC. I've always found it odd that many of the packages on certain linux distributions were old . Like how one time the latest openvpn version on the latest Ubuntu release was a year old.

plopz 7y ago
Debian 8 is still on php 5.6 which is EOL, even if you upgrade to debian 9 you would be on php 7.0 which is also EOL.
- apocalyptic0n3 7y ago
  Debian 10 is running 7.3, thankfully. But their LTS runs for 5 years and 7.3 will be EOL about 7 months before Buster and active support dropped about 17 months before. And PHP 7.4 is due out in November/December. So Buster will be outdated with its PHP release 6 months after release.

sleepysysadmin 7y ago

Delete

stronglikedan 7y ago
> Is the fix lawyers suing them all for libel/slander? IMHO, it's definitely time for this to be allowed.

p49k 7y ago

Gizmodo posts the headline on their front page, "You Might Want to Uninstall VLC. Immediately" Following the debunking of the story, what does Gizmodo do? Leave it on the front page and change the headline to "You Might Want to Uninstall VLC. Immediately [Updated]"

GunniH 7y ago
They actually did. >You Might Want to Uninstall VLC. Immediately. [Updated: Maybe Not] Is the current title...
- dvtrn 7y ago
  We have reached out to both companies for more info on what happened regarding the initial CVE Should have done that from the very beginning, as should have MITRE before publishing a CVE ID. Failures all around on this one. Sorry you’re having such a shit morning, jbk, because of other people’s laziness.
- NikolaeVarius 7y ago
  Its amazing how a title can have two entirely contradictory, non committal claims telling you to do a thing, and yet tell me absolutely nothing useful.
  - madez 7y ago
    Will you still read Gizmodo or consider it a trustable source?
    - NikolaeVarius 7y ago
      I read gizmodo every once in a while for mild entertainment. I have never considered it, or anything related to Kinja, to be trustworthy in any shape or form.
    - chachachoney 7y ago
      The Gell-Man amnesia effect is quite strong.

Aissen 7y ago

It's funny jbk did a talk at Pass the Salt this year entirely prophesying this type of event (it's not the first time this happens…): https://passthesalt.ubicast.tv/videos/vlc-and-security/ https://passthesalt.ubicast.tv/videos/vlc-and-security/ I took live notes (not nearly as colorful as the talk) here: https://anisse.astier.eu/pass-the-salt-2019-2.html https://anisse.astier.eu/pass-the-salt-2019-2.html

tptacek 7y ago

Just to clarify things: CVSS scores are almost completely meaningless and nobody should take them seriously. They're a Ouija Board that can be made to say anything.

reneberlin 7y ago

The users booting up Windose to use VLC have a much bigger problem in terms of vulerability than this reportedly false claim on the VLC-app. But - they don't know. And the newspapers will not report it in a dramatic post like this one.

carlob 7y ago

Completely OT: does anyone else find this style of posting stuff on a very long twitter thread hard to read, and somewhat worrying in terms of dependency on a proprietary platform? Why can't this be upfront on the videolan.org homepage and just linked from a single tweet?

lysp 7y ago
Change the twitter domain: https://twitter.com/videolan/status/1153963312981389312 https://twitter.com/videolan/status/1153963312981389312 to: https://threadreaderapp.com/videolan/status/1153963312981389312 https://threadreaderapp.com/videolan/status/1153963312981389...
- carlob 7y ago
  I know about that, I was more interested in the political point of being beholden to a proprietary platform. I think that is especially important for one of the most widely installed open source apps (on non-geeks computers).
whereistimbo 7y ago
For more publicity.
- jbk 7y ago
  This is, unfortunately, the answer. Whenever we post something, unless it is on Twitter, noone reads it.

lsferreira42 7y ago

It's on the front page of the most acessed tech blogs in Brazil too, this is a shame!

xs83 7y ago

I'm sorry but this is a shitty response from VLC: >The reporter is using Ubuntu 18.04, which is an old version of Ubuntu, and clearly has not all the updated libraries. 18.04 is an LTS version, many people (myself included) will be using this until 20.04 comes out next year! It is not old - it gets regular updates for both security and features - clearly the library for whatever reason is excluded.

bscphil 7y ago
They aren't blaming you for using the LTS version, and they aren't blaming Ubuntu for having an LTS version. The blame is (implicitly) on Ubuntu for not making sure the libraries their LTS version ships are up to date with the latest security patches. VLC itself isn't vulnerable - the problem is that some distributions are compiling it themselves with old libraries, which is 100% their own fault.

trilila 7y ago

gizmodo.com.au still shows "You Might Want To Uninstall VLC. Right Now. Immediately." in their title. This highlights the untrustworthiness of most "news" today, be it software, politics or business related. It's unbelievable how poorly researched articles can damage people and businesses alike. I think is this is one of the biggest pain points of today's world, and it needs solving fast.