what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

BlazeVideo HDTV Player Pro 6.6 Filename Handling

Posted Nov 30, 2012

Authored by sinn3r, b33f | Site metasploit.com

This Metasploit module exploits a vulnerability found in BlazeVideo HDTV Player's filename handling routine. When supplying a string of input data embedded in a .plf file, the MediaPlayerCtrl.dll component will try to extract a filename by using PathFindFileNameA(), and then copies whatever the return value is on the stack by using an inline strcpy. As a result, if this input data is long enough, it can cause a stack-based buffer overflow, which may lead to arbitrary code execution under the context of the user.

tags | exploit, overflow, arbitrary, code execution

advisories | OSVDB-80896

SHA-256 | ab34370a5debea1b2a8db24c582834304ee72c0e5a992dbbbcfedc31867011f6

Download | Favorite | View

Related Files

No related files