5 ms·

https://news.softpedia.com/news/critical-flaw-in-vlc-media-player-discovered-by-german-cybersecurity-agency-526768.shtml https://news.softpedia.com/news/critica

https://news.softpedia.com/news/critical-flaw-in-vlc-media-player-discovered-by-german-cybersecurity-agency-526768.shtml https://news.softpedia.com/news/critical-flaw-in-vlc-media-p... sources https://winfuture.de/news,110171.html https://winfuture.de/news,110171.html sources https://www.cert-bund.de/advisoryshort/CB-K19-0634 https://www.cert-bund.de/advisoryshort/CB-K19-0634 sources https://nvd.nist.gov/vuln/detail/CVE-2019-13615 https://nvd.nist.gov/vuln/detail/CVE-2019-13615 which finally gets to the bug report https://trac.videolan.org/vlc/ticket/22474 https://trac.videolan.org/vlc/ticket/22474 To boot https://www.securityfocus.com/bid/109304 https://www.securityfocus.com/bid/109304 claims all versions are vulnerable and the vendor reported it

jbk 7y ago
> To boot https://www.securityfocus.com/bid/109304 https://www.securityfocus.com/bid/109304 claims all versions are vulnerable and the vendor reported it Of course, we never reported such a thing: a security issue in a 3rd party library, fixed more than 16months ago. And VLC binaries were updated 16months ago too... The issue is that MITRE is not doing its job when assigning the CVE or even checking the validity of the claim. But they refuse to talk to us. Why?
- dsfyu404ed 7y ago
  >But they refuse to talk to us. Why? Because stonewalling is SOP for government bureaucracies when they screw up. When you're the government the various systems the people you screwed have for recourse work slightly differently so stonewalling works better than spewing out a ton of deny and distract PR like corporations do.
  - majewsky 7y ago
    > Because stonewalling is SOP for big orgs when they screw up. FTFY A lot of people seem to be under the impression that when you just privatize a government agency, it magically becomes better. It doesn't.
tastroder 7y ago
I really wonder where the CVE got their "attack vector: network" and CERT "remote: yes" classifications from. Even on vulnerable systems this seems to have been a local issue (or do they do that for anything that might potentially pull malicious files from outside sources? Sounds kind of backwards.)
- jbk 7y ago
  > I really wonder where the CVE got their "attack vector: network" and CERT "remote: yes" classifications from. They always do that with VLC: even file can be on a playlist, and a playlist can be sent by email or over the web, with a link... So they classify all VLC bugs with network and remote.
  - virgilp 7y ago
    By that token, is there ANY application where the attack vector is not 'network' and 'remote' is 'no'? Because I fail to think of any minimally-useful app that doesn't open external files.
    - jbk 7y ago
      Because we support playlists. I know it does make sense, but Mitre is never answering.
    - throwaway_391 7y ago
      CVSS is an insane rating system made for a simpler time by antiquated practices which doesn't account for many factors either well if at all. Hover your mouse over each button https://www.first.org/cvss/calculator/3.0 https://www.first.org/cvss/calculator/3.0 . There's Attack complexity 'low' and 'high', for instance. You're either a script kiddie or have a two billion dollar exploitation budget and all the human resources you need, but nothing in between.
      - wademealing 7y ago
        I will wear my vendor hat here for a moment, AC not about the attacker, but the configuration of the component being assessed.

jbk 7y ago

> To boot https://www.securityfocus.com/bid/109304 https://www.securityfocus.com/bid/109304 claims all versions are vulnerable and the vendor reported it Of course, we never reported such a thing: a security issue in a 3rd party library, fixed more than 16months ago. And VLC binaries were updated 16months ago too... The issue is that MITRE is not doing its job when assigning the CVE or even checking the validity of the claim. But they refuse to talk to us. Why?

dsfyu404ed 7y ago
>But they refuse to talk to us. Why? Because stonewalling is SOP for government bureaucracies when they screw up. When you're the government the various systems the people you screwed have for recourse work slightly differently so stonewalling works better than spewing out a ton of deny and distract PR like corporations do.
- majewsky 7y ago
  > Because stonewalling is SOP for big orgs when they screw up. FTFY A lot of people seem to be under the impression that when you just privatize a government agency, it magically becomes better. It doesn't.

tastroder 7y ago

I really wonder where the CVE got their "attack vector: network" and CERT "remote: yes" classifications from. Even on vulnerable systems this seems to have been a local issue (or do they do that for anything that might potentially pull malicious files from outside sources? Sounds kind of backwards.)

jbk 7y ago
> I really wonder where the CVE got their "attack vector: network" and CERT "remote: yes" classifications from. They always do that with VLC: even file can be on a playlist, and a playlist can be sent by email or over the web, with a link... So they classify all VLC bugs with network and remote.
- virgilp 7y ago
  By that token, is there ANY application where the attack vector is not 'network' and 'remote' is 'no'? Because I fail to think of any minimally-useful app that doesn't open external files.
  - jbk 7y ago
    Because we support playlists. I know it does make sense, but Mitre is never answering.
  - throwaway_391 7y ago
    CVSS is an insane rating system made for a simpler time by antiquated practices which doesn't account for many factors either well if at all. Hover your mouse over each button https://www.first.org/cvss/calculator/3.0 https://www.first.org/cvss/calculator/3.0 . There's Attack complexity 'low' and 'high', for instance. You're either a script kiddie or have a two billion dollar exploitation budget and all the human resources you need, but nothing in between.
    - wademealing 7y ago
      I will wear my vendor hat here for a moment, AC not about the attacker, but the configuration of the component being assessed.