VLC threatens to sue Secunia over full disclosure

https://secunia.com/blog/372/

by D3c4ff • 13 years ago

118 47 13 years ago

secunia.com

janerik• 13 years ago

Discussion here: https://news.ycombinator.com/item?id=6015509

Also see the response from VLC: http://www.jbkempf.com/blog/post/2013/More-lies-from-Secunia

Maxious• 13 years ago

VLC/Jean-Baptiste Kempf rebuttal: http://www.jbkempf.com/blog/post/2013/More-lies-from-Secunia

Comments on rebuttal ask "why don't they provide you with working exploit? (in example EIP = 0x41414141)"

So someone claims they did attaching an example mkv file? http://seclists.org/fulldisclosure/2013/Jul/71 https://twitter.com/coolkaveh/status/354716804783943680

nknighthb5• 13 years ago

I don't even care who's right about the vulnerability, threatening legal action in a case like this is so beyond the pale that the VLC project has just lost all credibility with me.

Even worse, while attacking Secunia for supposed "lies", they confess to a lie of their own:

https://twitter.com/videolan/status/354861344710864896

Unbelievable.

jbk13• 13 years ago

I don't even care who's right about the vulnerability, threatening legal action in a case like this is so beyond the pale

At some point, you need to make them react. And the only way a small open source project can get an answer from a big company is usually threat to attack their wallet.

Sure, it might have been not the best thing to say, but I don't know how else we can make them react on the various issues that have been going on for years with Secunia.

mariusmg• 13 years ago

That screenshots doesn't really prove anything. I mean....i can't even tell is it's the latest vlc version.

Anyway....interesting debate about statically linked libraries. Seems like the original vulnerability was in ffmpeg (vlc statically links to it). So in this case what should/can videolan do ?

maaaats2• 13 years ago

One can argue that for a user it doesn't matter if it's ffmpeg, VLC or something else that's buggy. A user is installing VLC, has probably no knowledge of what ffmpeg is, and it's the use of VLC that exposes the user to the security bug.

As such, it's VLC responsibility to not ship a product that may harm a user's computer, even if the error is not in their code.

_b8r02• 13 years ago

Videolan should fix the bug. Secunia should report the bug to ffmpeg. If the bug's fixed by a later version of ffmpeg then great, use a later version. If it's not, fix the bug, wait for ffmpeg to have a fixed update and off you go.

To give you a similar example, have a look at this post about the impact of vulnerabilities in third party libraries on commercial forensic products[1].

I would suspect that expert witnesses relying on this could have a case argued against them in court regarding the integrity of the application data and their processes if they're not prepared.

[1] https://www.cert.org/blogs/certcc/2013/07/forensics_software...

jbk13• 13 years ago

The issue on the screenshot is an unhandled exception in the MKV plugin of VLC. It should not be exploitable, and has already been patched in months.

jkrems• 13 years ago

The funny thing is that the rebuttal is not even denying the claims by Secunia. He is reiterating multiple times "But the PoC didn't work anymore!" while this is something the Secunia post explicitly admits (while saying that the fix that broke the PoC just did make it harded to exploit the ffmpeg-issue, not impossible). Feels like a lot of emotion involved in this one, and a little bit too much shouting "Lies! Lies! Lies!" again and again for my taste.

jbk13• 13 years ago

It is impossible to check the ffmeg-issue, without PoC (that they refuse to share) because they are so many that actually exist.

Yet, they actually faked a report and lied about the Impact of the MKV issue...

jbk13• 13 years ago

And this mkv file is, as far as I know, not an exploit. See http://seclists.org/fulldisclosure/2013/Jul/73

erikb2• 13 years ago

Oh, the response looks as bad as the blog post by Secunia. Well that's rather disappointing. I don't know much about security, but claiming an exploit is not possible anymore simply because the original implementation doesn't break the program anymore just doesn't seem very convincing. Same goes for calling all statement lies, that the author disagrees with.

Well at least it's not wonder why those 2 groups fail to communicate. Thanks for the update Maxious!

jezfromfuture• 13 years ago

More lies..

brazzy• 13 years ago

From whom? To me, Secunia seems to be acting much more mature and in good faith here.

jbk13• 13 years ago

https://news.ycombinator.com/item?id=6019172

callesgg• 13 years ago

Secunia has in my eyes never been a particly nice company. This just seams silly.

Tobu• 13 years ago

VLC threatens to sue Secunia over full disclosure

Not full disclosure at all, just security claims that no one can back up.

lucb1e• 13 years ago

As far as I knew VLC is an open-source project. It completely replaced any other media players I used as it worked great and was free. I believed they finally made a great open-source media player. Now they're threatening to sue some company. What the hell, where do they even get the resources? And why do they need to sue anyone anyway? I'm not sure I like VLC as much anymore...

Rantenki• 13 years ago

As it is an open source project, and they obviously have some internal communications issues at VLC, it is likely that you would get a different response and opinion about this depending on who at VLC you talked to. They don't have a traditional legal/PR/management structure, so they're naturally going to be more chaotic when dealing with things.

This isn't necessarily a bad thing, they're probably more resilient as well due to that loosely coupled structure, it just means that sometimes you get inconsistent communications, sometimes about important topics. It would be a mistake to think that VLC has some underlying dislike of vulnerability reports or an aversion to fixing known bugs, and I would be really surprised if counsel has been retained (or has vetted) this 'plan' to sue.

jokoon• 13 years ago

why should secunia feel so insulted ?

why shouldn't secunia work with him about the exploit ?

anExcitedBeast2• 13 years ago

Surprisingly childish behavior from both companies. Stop trying to embarrass each other and spend thirty minutes on the phone like adults.

parfe• 13 years ago

VideoLAN nor VLC are companies.

anExcitedBeast2• 13 years ago

True, thanks.

Glyptodon2• 13 years ago

If this is an ffmpeg bug why is VLC in the middle?

jbk13• 13 years ago

Because VLC uses ffmpeg for some codec modules.

vinhboy• 13 years ago

Thank you for working on VLC. It's a great software.

But I have to ask, why it is so important to VLC, or you, that secunia take down their advisory? Does it really affect VLC negatively?

Glyptodon2• 13 years ago

I meant more why aren't they bugging ffmpeg devs instead of VLC ones.

kwestro• 13 years ago

To Secunia. Law 101. Don't talk about incidents when you're being sued. Wide open grounds for incrimination.

erikb2• 13 years ago

Well maybe VLC did something wrong or not. How can we say that simply from that article. The only things I can see for sure are (A) that Secunia failed to communicate their issues to VLC and (B) that Secunia seems to consider their own policies as god given laws which all other companies must abide to as well. Both points don't seem all too convincing.

theboss• 13 years ago

Well VLC does have a case for libel if they were to take secunia to court. Would be interesting to see.

ExpiredLink• 13 years ago

Seems to be a clever marketing campaign by Secunia. Exploit an OS project to promote your own company. Make noise. Clever!

tzs• 13 years ago

This is a dup (with a / appended to the URL) from yesterday, which already had discussion:

https://news.ycombinator.com/item?id=6015509

VLC threatens to sue Secunia over full disclosure

Related Stories