3 ms·

Just because you assume that VLC is going to be used as a desktop application and that exploitation would require opening a file by hand, doesn't mean that matc

Just because you assume that VLC is going to be used as a desktop application and that exploitation would require opening a file by hand, doesn't mean that matches every use case. VLC has broadcasting, relaying, stream processing capabilities, all scriptable. I have done POC transcoding and broadcast applications that required VLC. In these cases, a denial of service might be serious. Also, a use after free may involve other vulnerabilities that require more effort to exploit, but the onus is not on the reporter to iterate every possibility, it is on the developers to fix the bug. This really sounds like an argument over triage of bugs for VLC (and perhaps some bad internal communications practices), and the VLC devs don't seem to understand that nobody cares about their internal process, just about getting the bugs fixed.

jerf 13y ago
I'm not assuming anything. In fact my post has nothing to do with VLC, really. I'm challenging the idea that a crashing bug in a desktop app is a "denial of service". That's not a useful use of the term. If you want to talk about a different type of bug, go ahead... and you will be talking about a different kind of bug, so my comment won't apply to your new bug.
- epochwolf 13y ago
  You completely missed the point. VLC is not just a desktop app. It's scriptable so it can be run on a headless server. Open Office is a desktop application but it's also a library that can be scripted against.
  - jerf 13y ago
    If I'm not really talking about VLC, how can I be missing the point? I'm making the point I'm making. I have no obligation to be making the point you think I'm making, or you think I should make. You feel free to make others.
    - epochwolf 13y ago
      The point was VLC is more than a desktop app. It's a service and a crash on invalid input is a security vulnerability for denial of service. If apache crashed on a mistyped http header it would be a security issue.
Rantenki 13y ago
Right, and I am saying that VLC is not only a Desktop app, it has extensive remote capabilities as well: http://www.videolan.org/doc/streaming-howto/en/ch04.html http://www.videolan.org/doc/streaming-howto/en/ch04.html and http://www.videolan.org/doc/streaming-howto/en/ch05.html http://www.videolan.org/doc/streaming-howto/en/ch05.html , which means that it is going to get used in ways involving automation, which means it might be injesting arbitrary files. Don't get me wrong, I am not saying that is a good idea (I decided against it), but that the scope of this bug is much larger than just a desktop "Don't open that file then" kind of bug.

jerf 13y ago

I'm not assuming anything. In fact my post has nothing to do with VLC, really. I'm challenging the idea that a crashing bug in a desktop app is a "denial of service". That's not a useful use of the term. If you want to talk about a different type of bug, go ahead... and you will be talking about a different kind of bug, so my comment won't apply to your new bug.

epochwolf 13y ago
You completely missed the point. VLC is not just a desktop app. It's scriptable so it can be run on a headless server. Open Office is a desktop application but it's also a library that can be scripted against.
- jerf 13y ago
  If I'm not really talking about VLC, how can I be missing the point? I'm making the point I'm making. I have no obligation to be making the point you think I'm making, or you think I should make. You feel free to make others.
  - epochwolf 13y ago
    The point was VLC is more than a desktop app. It's a service and a crash on invalid input is a security vulnerability for denial of service. If apache crashed on a mistyped http header it would be a security issue.

Rantenki 13y ago

Right, and I am saying that VLC is not only a Desktop app, it has extensive remote capabilities as well: http://www.videolan.org/doc/streaming-howto/en/ch04.html http://www.videolan.org/doc/streaming-howto/en/ch04.html and http://www.videolan.org/doc/streaming-howto/en/ch05.html http://www.videolan.org/doc/streaming-howto/en/ch05.html , which means that it is going to get used in ways involving automation, which means it might be injesting arbitrary files. Don't get me wrong, I am not saying that is a good idea (I decided against it), but that the scope of this bug is much larger than just a desktop "Don't open that file then" kind of bug.