VLC and Other Popular Media Players Affected by Critical Vulnerability

• A critical vulnerability has been discovered by security research company Cisco Talos Intelligence Group.
• The bug affects a number of popular media players including VLC and MPlayer.
• The vulnerability resides in the HTTP packet parsing functionality in the media players.

Security research company CISCO Talos has identified a critical vulnerability bug that has sent desktop users panicking. The vulnerability was found in the Live Networks LIVE555 streaming media RTSPServer which is found in popular media players including MPlayer and VLC Media player.

Security researcher Lilith Wyatt of Cisco Talos explained how the vulnerability could be exploited in her post stating “An exploitable code execution vulnerability exists in the HTTP packet-parsing functionality of the LIVE555 RTSP server library. A specially crafted packet can cause a stack-based buffer overflow, resulting in code execution. An attacker can send a packet to trigger this vulnerability.”

The developers behind the media players have already been notified prior to Cisco revealing details of the bug. All the affected media players have already been patched and to prevent any security risks, it is recommended that you update to the latest versions of the listed players immediately. Cisco has not explicitly mentioned the names of the media players outside of VLC and MPlayer, but it has been implied that most of these media players are embedded into cameras, so it is recommended that you update your imaging hardware to the latest firmware version as well.

The prompt action by the developers of the media players suggests that the vulnerability was highly dangerous and could have put PCs at risk from cybercriminals. VLC has had its fair share of security problems over the years, and it still continues to be popular. MPlayer also commands a substantial user base and is one of the most popular media players that desktop users choose over the default Windows Media Player which is fairly barebones in comparison. The vulnerability has been posted by Cisco in the National Vulnerability database which offers technical details on the exploit.

What do you think about the vulnerability found by Cisco Talos? Let us know in the comments below. Also, to get instant tech updates, follow TechNadu’s Facebook page, and Twitter handle.