CVE-2023-47360
📋 TL;DR
CVE-2023-47360 is an integer underflow vulnerability in VLC media player's MMS protocol handler that can cause incorrect packet length calculations. This could allow remote attackers to trigger memory corruption issues. Users running VLC versions prior to 3.0.20 are affected when processing malicious media streams.
💻 Affected Systems
- VLC media player
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise when processing a malicious media stream
Likely Case
Application crash (denial of service) or potential information disclosure through memory corruption
If Mitigated
Application crash with no further impact if memory protections are enabled
🎯 Exploit Status
Exploitation requires user to open malicious media stream; technical details and proof-of-concept are publicly available
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.20 and later
Vendor Advisory: https://www.videolan.org/security/sb-vlc3020.html
Restart Required: Yes
Instructions:
1. Download VLC 3.0.20 or later from videolan.org
2. Install the update
3. Restart VLC and any running instances
🔧 Temporary Workarounds
Disable MMS protocol
allPrevent VLC from handling MMS streams by disabling the protocol handler
Not applicable - requires GUI configuration: Tools > Preferences > Input/Codecs > Demuxers > uncheck 'MMS'
Network filtering
linuxBlock MMS protocol traffic at network perimeter
iptables -A OUTPUT -p tcp --dport 1755 -j DROP
iptables -A OUTPUT -p udp --dport 1755 -j DROP
🧯 If You Can't Patch
- Restrict VLC to trusted media sources only
- Implement application whitelisting to prevent unauthorized VLC execution
🔍 How to Verify
Check if Vulnerable:
Check VLC version: Help > About (GUI) or 'vlc --version' (CLI)Check Version:
vlc --version | head -1Verify Fix Applied:
Confirm version is 3.0.20 or higher📡 Detection & Monitoring
Log Indicators:
- VLC crash logs
- Application error events mentioning VLC
Network Indicators:
- MMS protocol traffic (TCP/UDP port 1755) to untrusted sources
SIEM Query:
EventID=1000 OR EventID=1001 AND ProcessName='vlc.exe'