exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

VLC Media Player 1.0.5 Goldeneye Buffer Overflow

VLC Media Player 1.0.5 Goldeneye Buffer Overflow
Posted Mar 5, 2010
Authored by LiquidWorm

VLC Media Player version 1.0.5 Goldeneye suffers from a remote buffer overflow vulnerability.

tags | advisory, remote, overflow
SHA-256 | 45fefeb10cd2a4179005d5fc8f1bb446d212e60c0c3bd235dc346b222895e4af

VLC Media Player 1.0.5 Goldeneye Buffer Overflow

Change Mirror Download


VLC media player 1.0.5 Goldeneye (bookmarks) Remote Buffer Overflow PoC



Advisory: http://zeroscience.mk/en/vulnerabilities/ZSL-2010-4931.php

Summary: VLC media player is a highly portable multimedia player
and multimedia framework capable of reading most audio
and video formats (MPEG-2, MPEG-4, H.264, DivX, MPEG-1,
mp3, ogg, aac ...) as well as DVDs, Audio CDs VCDs, and
various streaming protocols.


Description: VLC media player is vulnerable to a buffer overflow
attack when processing .mp3 file and its metadata.
It fails to perform boundry checks when creating a
bookmark from the malicious media file playing,
resulting in a crash, overwriting ECX register.

While the evil .mp3 is playing, you go Playback >
Bookmarks > Manage bookmarks > Create.

Tested on Microsoft Windows XP Professional SP3 (EN)

Version affected: 1.0.5 Goldeneye

Product web page: http://www.videolan.org

Vendor: VideoLAN team


-------------------------------------------------------------------------

(e48.10fc): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=039fe008 ebx=00001200 ecx=41414141 edx=03b7ab88 esi=039fe000 edi=004d0000
eip=7c911895 esp=04befcd8 ebp=04befcf0 iopl=0 nv up ei ng nz ac po cy
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010293
ntdll!RtlInitializeCriticalSection+0x298:
7c911895 8901 mov dword ptr [ecx],eax ds:0023:41414141=????????

-------------------------------------------------------------------------



Vulnerability discovered by Gjoko 'LiquidWorm' Krstic

liquidworm gmail com

Zero Science Lab - http://www.zeroscience.mk

28.02.2010




PoC:

http://zeroscience.mk/codes/aimp2_evil.mp3

[mirror] http://milw0rm.com/sploits/2009-aimp2_evil.mp3
[mirror] http://securityreason.com/download/11/13




//EOF
Login or Register to add favorites

File Archive:

February 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    11 Files
  • 2
    Feb 2nd
    9 Files
  • 3
    Feb 3rd
    0 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    0 Files
  • 6
    Feb 6th
    0 Files
  • 7
    Feb 7th
    0 Files
  • 8
    Feb 8th
    0 Files
  • 9
    Feb 9th
    0 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    0 Files
  • 13
    Feb 13th
    0 Files
  • 14
    Feb 14th
    0 Files
  • 15
    Feb 15th
    0 Files
  • 16
    Feb 16th
    0 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    0 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close