Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

About the “Security Issue” on VLC

twitter.com

Post reply on HN
Print view View original

41–50 of 174 posts

Re: About the “Security Issue” on VLC

#41

Post by yrro »

hs86 wrote: post #21

libebml is in the Ubuntu universe repository which means that it is not supported by Canonical. And in the Debian changelog for this package I don't see any mentions of a security issue that was fixed 16 months ago: https://metadata.ftp-master.debian.org/changelogs//main/libe... I am loosing more and more confidence that these "package the world and freeze everything in place" distros are the right choice for end use…

FYI given a CVE or package name, you can view the state of a particular issue across all Debian versions using the Security Bug Tracker. For instance

https://security-tracker.debian.org/tracker/CVE-2019-13615

In this case, this hasn't yet been updated with the info from the VLC team, I expect it'll be marked ignore or not-vulnerable once that happens.

I don't know the real CVE for the libebml issue but it doesn't appear to be listed at https://security-tracker.debian.org/tracker/source-package/l... which means that the Debian security team aren't aware of it.

Re: About the “Security Issue” on VLC

#44

Post by pdpi »

onli wrote: post #20

I don't like the exchange with TheRegister: > TheRegister: FWIW we reported the VLC developers were skeptical. Happy to update our coverage accordingly. > Tho, FWIW, the PoC .MP4 seg-faulted our 3.0.7 VLC installation. > VideoLAN: using a linux distribution? with an old libebml? > TheRegister: Using Debian 9.9, using libebml4v5 1.3.4-1 > VideoLAN: Yes, so your issue is your distribution is not up-to-date, not VLC. No…

I'd argue that, in a dynamically linked system, the onus in on the system maintainer, not the application developer, to fix these issues.

Re: About the “Security Issue” on VLC

#45

Post by onli »

kalleboo wrote: post #38
onli wrote: post #20

I don't like the exchange with TheRegister: > TheRegister: FWIW we reported the VLC developers were skeptical. Happy to update our coverage accordingly. > Tho, FWIW, the PoC .MP4 seg-faulted our 3.0.7 VLC installation. > VideoLAN: using a linux distribution? with an old libebml? > TheRegister: Using Debian 9.9, using libebml4v5 1.3.4-1 > VideoLAN: Yes, so your issue is your distribution is not up-to-date, not VLC. No…

Is it now the responsibility of every piece of software to check the versions of every library they're linked to for security patches? Shouldn't that be the responsibility of the distribution? edit: is there even a common method for the developer of a library like libebml to flag an update as a security fix to increase the priority of it, or is that up to the package maintainers of each individual distribution to det…

My point is a different one: If a user or a journalist installs the current version of the software and he runs a current distro it is not a surprise that he assumes a (security) flaw that manifests when using that program is caused by the program. The main project does not necessarily have to fix it themselves, but ideally would notify the distro (and that would make for a good response).

Re: About the “Security Issue” on VLC

#46

Post by jbk »

onli wrote: post #45
kalleboo wrote: post #38

Earlier quoted context omitted.

Is it now the responsibility of every piece of software to check the versions of every library they're linked to for security patches? Shouldn't that be the responsibility of the distribution? edit: is there even a common method for the developer of a library like libebml to flag an update as a security fix to increase the priority of it, or is that up to the package maintainers of each individual distribution to det…

My point is a different one: If a user or a journalist installs the current version of the software and he runs a current distro it is not a surprise that he assumes a (security) flaw that manifests when using that program is caused by the program. The main project does not necessarily have to fix it themselves, but ideally would notify the distro (and that would make for a good response).

a journalist is on Windows or mac. They could even chekc that it does not crash with the provided sample.

Re: About the “Security Issue” on VLC

#47

Post by kalleboo »

onli wrote: post #45
kalleboo wrote: post #38

Earlier quoted context omitted.

Is it now the responsibility of every piece of software to check the versions of every library they're linked to for security patches? Shouldn't that be the responsibility of the distribution? edit: is there even a common method for the developer of a library like libebml to flag an update as a security fix to increase the priority of it, or is that up to the package maintainers of each individual distribution to det…

My point is a different one: If a user or a journalist installs the current version of the software and he runs a current distro it is not a surprise that he assumes a (security) flaw that manifests when using that program is caused by the program. The main project does not necessarily have to fix it themselves, but ideally would notify the distro (and that would make for a good response).

Your post said "notify users about", which is where my comment came from.

Notifying distros is something they could do, but how many/which distros do they have to notify? It seems like it could be a massive job in itself. Hence my edit :p

Re: About the “Security Issue” on VLC

#48

Post by yjftsjthsd-h »

gsich wrote: post #43
codewithcheese wrote: post #18

> The reporter is using Ubuntu 18.04, which is an old version of Ubuntu, and clearly has not all the updated libraries. It's not a "old" version of Ubuntu its the latest LTS.

The library is not the newest one, so it is by definition, old.

Sorta, but most people mean "obsolete, shouldn't use" when they say old. For instance, postgres currently has 5 in-support versions going back to 9.4; are 9.4-10 "old"?

Re: About the “Security Issue” on VLC

#49

Post by kuschku »

onli wrote: post #20

I don't like the exchange with TheRegister: > TheRegister: FWIW we reported the VLC developers were skeptical. Happy to update our coverage accordingly. > Tho, FWIW, the PoC .MP4 seg-faulted our 3.0.7 VLC installation. > VideoLAN: using a linux distribution? with an old libebml? > TheRegister: Using Debian 9.9, using libebml4v5 1.3.4-1 > VideoLAN: Yes, so your issue is your distribution is not up-to-date, not VLC. No…

If you download the VLC build from VLC themselves, it won’t crash.

It’s simply that Debian/Ubuntu patch VLC to use an older version of the library, which of course is broken and has the bug.

Re: About the “Security Issue” on VLC

#50

Post by kalleboo »

jbk wrote: post #46
onli wrote: post #45

Earlier quoted context omitted.

My point is a different one: If a user or a journalist installs the current version of the software and he runs a current distro it is not a surprise that he assumes a (security) flaw that manifests when using that program is caused by the program. The main project does not necessarily have to fix it themselves, but ideally would notify the distro (and that would make for a good response).

a journalist is on Windows or mac. They could even chekc that it does not crash with the provided sample.

Although in this case, The Register journalist was on Debian, they checked it and it crashed (because Debian packages an old version)
Post reply on HN