DivX Player Vulnerability Confirmed
Security company Secunia has just published an advisory reporting a Subtitle Parsing Buffer Overflow vulnerability in DivX player, a quite popular
software solution on the web. According to Secunia's notification, the vulnerability has been confirmed to exist in DivX Player 6.7 (build 6.7.0.22), but previous releases may be affected as well. Although the developers of the program haven't yet released a patch or a fix to correct the issue, Secunia provided a solution which could be put into practice by all the users of the application: disable the automatic loading of subtitles and avoid opening suspicious or unknown subtitles coming from mistrusted sources.
Comments: Such a feature should exist in all software programs
"Securfrog has discovered a vulnerability in DivX Player, which can potentially be exploited by malicious people to compromise a user's system. The vulnerability is caused due to a boundary error in the processing of subtitles. This can be exploited to cause a stack-based buffer overflow via an overly long subtitle line contained in a malicious SRT file," Secunia wrote in the advisory published today. "Successful exploitation may allow execution of arbitrary code, but requires that the user is tricked into opening a specially crafted SRT file."
Secunia rated the flaw as highly critical, which underlines the level of the vulnerability and the need to patch it as soon as possible. However, due to the fact that developers haven't released a patch yet, you should really try to apply the solution mentioned above in order to be sure you remain on the safe side.
As you probably know, software vulnerabilities have always been one of the main problems for users who wanted to remain secure and, even if they kept the antivirus and the other security tools up-to-date, they still got their computer hacked or compromised. That's why it's pretty important to always install the latest software versions and apply the provided patches as soon as they're released.
[Source: softpedia]
Post a Comment