Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

What is the current status of the vulnerability in VLC Media Player reported by Secunia? I see that there has been some online discussion of this in places outside Hacker News (which I searched the other day for more information about Secunia's vulnerability report).

http://secunia.com/advisories/52956/

http://secunia.com/blog/shooting-the-messenger-372

http://it.slashdot.org/story/13/07/10/1520245/vlc-and-secuni...

I have tried to update VLC Media Player on one machine on my home network, and the update fails, suggesting that the VLC Media Player installation on that computer may already be compromised by malware (which has previously been detected on that machine). What is the recommendation for current VLC Media Player users to make sure that they have a recently updated, reasonably safe installation of VLC Media Player that doesn't open up their computer to other vulnerabilities?



The Secunia security issue SA51464 was never proved, never reproduceable and never fixed...

We did a lot of fuzzing with 2.1.x though and we've fixed all the security issues that were reported.


wait, so you currently have an infected computer on your home network?


Secunia reports that I need to update VLC Media Player on a computer from which I recently removed a lot of malware (with the help of Malware Bytes, of which I have a purchased copy on that computer). I installed Secunia on the same computer, and it has not been able to do its update of VLC Media Player, nor have I been able to get an update of that to install by going directly to the VLC Media Player website and downloading the latest version. That is worrisome.

Would I be better off just completely uninstalling VLC Media Player?

AFTER EDIT: I might have considered a direct answer to my question (whatever the answer was) more helpful than a silent downvote to what was, after all, just a polite response to a question that someone asked me.

AFTER FURTHER EDIT: After some more rebooting of the previously infected computer, the operating system and Secunia both report that VLC Media Player version 2.1.3 is installed, and that is not reported to have any problem by Secunia. So I will leave that alone. The computer from which I usually post to HN, a different computer on the same home network, does not have VLC Media Player installed. I try to keep a close-to-bare-stock set of installed programs on this computer, but other users in my household (= teenage boys who aspire to be hackers) tend to install programs I've never heard of on the other computer on our home network, and my wife, who has other things on her mind, occasionally doesn't notice installations of crapware or adware or bloatware that tag along with legitimate program updates on that computer. So that other computer tends to be the vector for malware attacks on the home network here. Thanks for any further comments participants here have on how to keep a home network safe when not all users follow strict quarantine policies.


I'd suggest just nuking the entirety of that computer from orbit. "Uninstalling" malware is not worth the risk/effort.


I imagine many of the downvotes were about how unrelated your post was to what was being discussed.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: