VLC player has critical security flaw - July 23, 2019 - UPDATED

[mouser]

Yikes -- this is concerning if you use VLC player to play media files.

Researchers from German firm CERT-Bund say they have detected a major safety flaw in the video player, which has been downloaded billions of times across the world, which could allow hackers access to compromise users' devices.

https://www.techradar.com/news/vlc-player-has-critical-security-flaw

[ConstanceJill]

It's only concerning if you play files from untrusted sources, though.

[mouser]

true

[IainB]

Yeah, I never did trust Bach anyway.
But in all seriousness, knowing of a flaw like that wouldn't bother me as I never have trusted VLC anyway. For years I have used it as my main/preferred audio player, but it was always blocked in the settings from going out to the net and I also blocked it at the firewall, just in case. Same with Windows Media Player - but that was because I figured MS (with its deliberate "Rights Management") was in cahoots with the apparent US government corruption by organisations such as (for example) the RIAA and MPAA, who had also got themselves embedded tick-like with the NZ government. Basically "legally" spying on users via ISPs, collecting their usage and downloading metadata and phoning home to good ol' MSHQ or somesuch with the info, prosecuting people for downloading freely available material. No thanks. I don't leave my door open for people/censors like that. My kids could (and do) download all sorts of harmless stuff that I don't need to know about - the harmful (e.g., malware, virus, trojan) stuff is automatically caught and blocked though.
That's why I used Windows Firewall Control (now owned by Malwarebytes), MAFIAA Fire, Simple DNSCrypt and the SoftEther VPN Client + VPN Gate Client Plug-in.

I value and protect the online security and privacy of myself and my family and I don't accept snooping and being "hit" by anyone, especially US or other nation corporate mafia-type organisations sanctioned by the state.

[Curt]

I never did trust Bach anyway.

yet  he will be Bach

[IainB]

I never did trust Bach anyway.
-IainB (Today at 05:40:09)

yet   he will be Bach

Har-de-har-har.
I just put that joke in as a placeholder whilst I wrote a (hopefully) useful response (done now, see above).

What is the question, the answer to which is "9W"?

Spoiler (click to show/hide)

Is that spelt with a "V" herr Vagner?

[mouser]

UPDATE:

https://www.ghacks.net/2019/07/24/confusion-critical-vlc-media-player-vulnerability/
"Update: VideoLAN confirmed that the issue was not a security issue in VLC Media Player. The engineers detected that the issue was caused by an older version of the third-party library called libebml that was included in older versions of Ubuntu. The researcher used that older version of Ubuntu apparently. End"

From VLC: "End of story: VLC is not vulnerable, whether this is 3.0.7.1 or even 3.0.4. The issue is in a 3rd party library, and it was fixed in VLC binaries version 3.0.3, out more than one year ago…"

[Deozaan]

Update: VideoLAN confirmed that the issue was not a security issue in VLC Media Player. The engineers detected that the issue was caused by an older version of the third-party library called libebml that was included in older versions of Ubuntu. The researcher used that older version of Ubuntu apparently. End

Wut?

The TechRadar article says:

The issue has been detected in the Windows, Linux and UNIX versions of VLC, however the macOS version appears to be unaffected.

VideoLAN, the not-for-profit organisation beind VLC Media Player, says it has been working on a patch for the flaw for the last four weeks, and is 60 percent through.

Where did they get the information that the exploit exists on multiple OSes and that VideoLAN was only 60% finished with a patch for the flaw when VideoLAN says it was fixed over a year ago and only vulnerable on an old^* version of Ubuntu which uses an old 3rd party library?




^* To be fair to the researcher, the "old" version of Ubuntu is supposedly Ubuntu 18.04, which is the most recent LTS version of Ubuntu.