5 ms·

VLC/Jean-Baptiste Kempf rebuttal: http://www.jbkempf.com/blog/post/2013/More-lies-from-Secunia http://www.jbkempf.com/blog/post/2013/More-lies-from-Secunia Co

by Maxious 13y ago

VLC/Jean-Baptiste Kempf rebuttal: http://www.jbkempf.com/blog/post/2013/More-lies-from-Secunia http://www.jbkempf.com/blog/post/2013/More-lies-from-Secunia Comments on rebuttal ask "why don't they provide you with working exploit? (in example EIP = 0x41414141)" So someone claims they did attaching an example mkv file? http://seclists.org/fulldisclosure/2013/Jul/71 http://seclists.org/fulldisclosure/2013/Jul/71 https://twitter.com/coolkaveh/status/354716804783943680 https://twitter.com/coolkaveh/status/354716804783943680

nknighthb 13y ago
I don't even care who's right about the vulnerability, threatening legal action in a case like this is so beyond the pale that the VLC project has just lost all credibility with me. Even worse, while attacking Secunia for supposed "lies", they confess to a lie of their own: https://twitter.com/videolan/status/354861344710864896 https://twitter.com/videolan/status/354861344710864896 Unbelievable.
- PhantomLobe 13y ago
  Stating that a product has a defect when it has not is pretty much libel.
- jbk 13y ago
  > I don't even care who's right about the vulnerability, threatening legal action in a case like this is so beyond the pale At some point, you need to make them react. And the only way a small open source project can get an answer from a big company is usually threat to attack their wallet. Sure, it might have been not the best thing to say, but I don't know how else we can make them react on the various issues that have been going on for years with Secunia.
  - nknighthb 13y ago
    > it might have been not the best thing to say Aside from the fact that it was socially unacceptable, do you realize you could have exposed yourself to legal attack? I don't know what rules are typical in Europe for declaratory judgement actions, but in the US, Secunia would have basis for filing against you to have their speech declared non-defamatory. If you don't have a lawyer to do it for you, don't threaten legal action.
    - jbk 13y ago
      Publishing private emails is probably illegal too (it is in Germany, in France and Italy)... And claiming a POC is 'arbitrary execution' when it is not... We go that road for a long time, you know... I would prefer spending my free time working on VLC (which I do usually) than having to deal with those things... Especially since we still have no vulnerability POC...
      - Svip 13y ago
        > Publishing private emails is probably illegal too (it is in Germany, in France and Italy)... It is not illegal in Denmark, if one of the participants publishes it. Similarly, it is not illegal to record a conversation in Denmark without acknowledgement from the other participants, if one of the participants is the one recording it.
      - nknighthb 13y ago
        > Publishing private emails is probably illegal too I don't claim to know the law on this in those countries, though Svip says it's not illegal in Denmark (Secunia's jurisdiction). Letter of the law aside, are court records not public in your jurisdiction? In the US, that email would have been promptly entered into evidence without redaction. In that light, posting it now makes no practical difference. You'd already dishonestly informed them you were commencing suit in 24 hours. > I would prefer spending my free time working on VLC Then do so. And if you really feel the VLC project needs to respond to Secunia in any way, have someone else do it. You're not very good at it.
        jbk 13y ago
        > Then do so. And if you really feel the VLC project needs to respond to Secunia in any way, have someone else do it. You're not very good at it. I'm so glad that you volunteered... Seriously, do you have any idea how few we are?
        nknighthb 13y ago
        A grep of your git log indicates at least 7 developers with >100 commits in recent history. I'd hope there's a decent chance at least one of them is better at crisis management and general PR. Certainly collectively you could have done better than the rushed (and at times nearly incomprehensible) statements you've been making.
mariusmg 13y ago
That screenshots doesn't really prove anything. I mean....i can't even tell is it's the latest vlc version. Anyway....interesting debate about statically linked libraries. Seems like the original vulnerability was in ffmpeg (vlc statically links to it). So in this case what should/can videolan do ?
- maaaats 13y ago
  One can argue that for a user it doesn't matter if it's ffmpeg, VLC or something else that's buggy. A user is installing VLC, has probably no knowledge of what ffmpeg is, and it's the use of VLC that exposes the user to the security bug. As such, it's VLC responsibility to not ship a product that may harm a user's computer, even if the error is not in their code.
  - PhantomLobe 13y ago
    > A user is installing VLC, has probably no knowledge of what ffmpeg is, and it's the use of VLC that exposes the user to the security bug. A user that won't care about that will neither care about Secunia.
  - jbk 13y ago
    All the known vulnerabilities have been fixed. Which one are you referring to?
    - maaaats 13y ago
      None in particular, just the general concept that you are responsible for all the parts in the end product, even if not made by you.
      - jbk 13y ago
        Oh, yes, we agree on that. Which is why we patched FFmpeg for the SWF issue.
- iuguy 13y ago
jkrems 13y ago
The funny thing is that the rebuttal is not even denying the claims by Secunia. He is reiterating multiple times "But the PoC didn't work anymore!" while this is something the Secunia post explicitly admits (while saying that the fix that broke the PoC just did make it harded to exploit the ffmpeg-issue, not impossible). Feels like a lot of emotion involved in this one, and a little bit too much shouting "Lies! Lies! Lies!" again and again for my taste.
- jbk 13y ago
  It is impossible to check the ffmeg-issue, without PoC (that they refuse to share) because they are so many that actually exist. Yet, they actually faked a report and lied about the Impact of the MKV issue...
jbk 13y ago
And this mkv file is, as far as I know, not an exploit. See http://seclists.org/fulldisclosure/2013/Jul/73 http://seclists.org/fulldisclosure/2013/Jul/73
- deleted 13y ago
  [deleted]
  - Tobu 13y ago
    That's an abort(). libmkv encounters an invalid file, throws an exception, vlc exits immediately.
  - jbk 13y ago
    Crashing does not mean exploitable. Moreover, it does not crash 2.1.0-pre1 and a work-around has been published (remove the libmatroska_plugin.dylib)
    - nknighthb 13y ago
      > Crashing does not mean exploitable. I realized what you meant after I posted that comment, so I deleted it (but obviously not before you replied). However we do disagree on the meaning of "exploit". If a file causes an application to crash, I consider that an exploit. It may not be arbitrary code execution, but it is exploitation of a denial of service vulnerability.
      - jbk 13y ago
        Yet http://secunia.com/advisories/52956/ http://secunia.com/advisories/52956/ calls it "Impact: System Access" and "Successful exploitation may allow execution of arbitrary code." Why wouldn't we be upset about that or call that a "lie"?
        nknighthb 13y ago
        I don't really care if you call it a lie or not. I care that you attempted to invoke the legal system over a dispute regarding a vulnerability. I also care that you, by your own admission, lied. Even if it were indisputably clear that Secunia did, in fact, knowingly lie about the vulnerability, I would still hold you in infinitely greater contempt for that sickening display of hypocrisy.
erikb 13y ago
Oh, the response looks as bad as the blog post by Secunia. Well that's rather disappointing. I don't know much about security, but claiming an exploit is not possible anymore simply because the original implementation doesn't break the program anymore just doesn't seem very convincing. Same goes for calling all statement lies, that the author disagrees with. Well at least it's not wonder why those 2 groups fail to communicate. Thanks for the update Maxious!

by Maxious 13y ago

nknighthb 13y ago

I don't even care who's right about the vulnerability, threatening legal action in a case like this is so beyond the pale that the VLC project has just lost all credibility with me. Even worse, while attacking Secunia for supposed "lies", they confess to a lie of their own: https://twitter.com/videolan/status/354861344710864896 https://twitter.com/videolan/status/354861344710864896 Unbelievable.

PhantomLobe 13y ago
Stating that a product has a defect when it has not is pretty much libel.
jbk 13y ago
> I don't even care who's right about the vulnerability, threatening legal action in a case like this is so beyond the pale At some point, you need to make them react. And the only way a small open source project can get an answer from a big company is usually threat to attack their wallet. Sure, it might have been not the best thing to say, but I don't know how else we can make them react on the various issues that have been going on for years with Secunia.
- nknighthb 13y ago
  > it might have been not the best thing to say Aside from the fact that it was socially unacceptable, do you realize you could have exposed yourself to legal attack? I don't know what rules are typical in Europe for declaratory judgement actions, but in the US, Secunia would have basis for filing against you to have their speech declared non-defamatory. If you don't have a lawyer to do it for you, don't threaten legal action.
  - jbk 13y ago
    Publishing private emails is probably illegal too (it is in Germany, in France and Italy)... And claiming a POC is 'arbitrary execution' when it is not... We go that road for a long time, you know... I would prefer spending my free time working on VLC (which I do usually) than having to deal with those things... Especially since we still have no vulnerability POC...
    - Svip 13y ago
      > Publishing private emails is probably illegal too (it is in Germany, in France and Italy)... It is not illegal in Denmark, if one of the participants publishes it. Similarly, it is not illegal to record a conversation in Denmark without acknowledgement from the other participants, if one of the participants is the one recording it.
    - nknighthb 13y ago
      > Publishing private emails is probably illegal too I don't claim to know the law on this in those countries, though Svip says it's not illegal in Denmark (Secunia's jurisdiction). Letter of the law aside, are court records not public in your jurisdiction? In the US, that email would have been promptly entered into evidence without redaction. In that light, posting it now makes no practical difference. You'd already dishonestly informed them you were commencing suit in 24 hours. > I would prefer spending my free time working on VLC Then do so. And if you really feel the VLC project needs to respond to Secunia in any way, have someone else do it. You're not very good at it.
      - jbk 13y ago
        > Then do so. And if you really feel the VLC project needs to respond to Secunia in any way, have someone else do it. You're not very good at it. I'm so glad that you volunteered... Seriously, do you have any idea how few we are?
        nknighthb 13y ago
        A grep of your git log indicates at least 7 developers with >100 commits in recent history. I'd hope there's a decent chance at least one of them is better at crisis management and general PR. Certainly collectively you could have done better than the rushed (and at times nearly incomprehensible) statements you've been making.

mariusmg 13y ago

That screenshots doesn't really prove anything. I mean....i can't even tell is it's the latest vlc version. Anyway....interesting debate about statically linked libraries. Seems like the original vulnerability was in ffmpeg (vlc statically links to it). So in this case what should/can videolan do ?

maaaats 13y ago
One can argue that for a user it doesn't matter if it's ffmpeg, VLC or something else that's buggy. A user is installing VLC, has probably no knowledge of what ffmpeg is, and it's the use of VLC that exposes the user to the security bug. As such, it's VLC responsibility to not ship a product that may harm a user's computer, even if the error is not in their code.
- PhantomLobe 13y ago
  > A user is installing VLC, has probably no knowledge of what ffmpeg is, and it's the use of VLC that exposes the user to the security bug. A user that won't care about that will neither care about Secunia.
- jbk 13y ago
  All the known vulnerabilities have been fixed. Which one are you referring to?
  - maaaats 13y ago
    None in particular, just the general concept that you are responsible for all the parts in the end product, even if not made by you.
    - jbk 13y ago
      Oh, yes, we agree on that. Which is why we patched FFmpeg for the SWF issue.
iuguy 13y ago

jkrems 13y ago

The funny thing is that the rebuttal is not even denying the claims by Secunia. He is reiterating multiple times "But the PoC didn't work anymore!" while this is something the Secunia post explicitly admits (while saying that the fix that broke the PoC just did make it harded to exploit the ffmpeg-issue, not impossible). Feels like a lot of emotion involved in this one, and a little bit too much shouting "Lies! Lies! Lies!" again and again for my taste.

jbk 13y ago
It is impossible to check the ffmeg-issue, without PoC (that they refuse to share) because they are so many that actually exist. Yet, they actually faked a report and lied about the Impact of the MKV issue...

jbk 13y ago

And this mkv file is, as far as I know, not an exploit. See http://seclists.org/fulldisclosure/2013/Jul/73 http://seclists.org/fulldisclosure/2013/Jul/73

deleted 13y ago
[deleted]
- Tobu 13y ago
  That's an abort(). libmkv encounters an invalid file, throws an exception, vlc exits immediately.
- jbk 13y ago
  Crashing does not mean exploitable. Moreover, it does not crash 2.1.0-pre1 and a work-around has been published (remove the libmatroska_plugin.dylib)
  - nknighthb 13y ago
    > Crashing does not mean exploitable. I realized what you meant after I posted that comment, so I deleted it (but obviously not before you replied). However we do disagree on the meaning of "exploit". If a file causes an application to crash, I consider that an exploit. It may not be arbitrary code execution, but it is exploitation of a denial of service vulnerability.
    - jbk 13y ago
      Yet http://secunia.com/advisories/52956/ http://secunia.com/advisories/52956/ calls it "Impact: System Access" and "Successful exploitation may allow execution of arbitrary code." Why wouldn't we be upset about that or call that a "lie"?
      - nknighthb 13y ago
        I don't really care if you call it a lie or not. I care that you attempted to invoke the legal system over a dispute regarding a vulnerability. I also care that you, by your own admission, lied. Even if it were indisputably clear that Secunia did, in fact, knowingly lie about the vulnerability, I would still hold you in infinitely greater contempt for that sickening display of hypocrisy.

erikb 13y ago

Oh, the response looks as bad as the blog post by Secunia. Well that's rather disappointing. I don't know much about security, but claiming an exploit is not possible anymore simply because the original implementation doesn't break the program anymore just doesn't seem very convincing. Same goes for calling all statement lies, that the author disagrees with. Well at least it's not wonder why those 2 groups fail to communicate. Thanks for the update Maxious!