Lucene search

Gjoko KrsticZSL-2010-4931

HistoryMar 05, 2010 - 12:00 a.m.

VLC media player 1.0.5 Goldeneye (bookmarks) Remote Buffer Overflow PoC

2010-03-0500:00:00

Gjoko Krstic

zeroscience.mk

7.6 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:H/Au:N/C:C/I:C/A:C

7 High

AI Score

Confidence

Low

0.035 Low

EPSS

Percentile

91.7%

JSON

Title: VLC media player 1.0.5 Goldeneye (bookmarks) Remote Buffer Overflow PoC
Advisory ID: ZSL-2010-4931
Type: Local/Remote
Impact: System Access, DoS
Risk: (5/5)
Release Date: 05.03.2010

Summary

VLC media player is a highly portable multimedia player and multimedia framework capable of reading most audio and video formats (MPEG-2, MPEG-4, H.264, DivX, MPEG-1, mp3, ogg, aac …) as well as DVDs, Audio CDs VCDs, and various streaming protocols.

Description

VLC media player is vulnerable to a buffer overflow attack when processing .mp3 file and its metadata. It fails to perform boundry checks when creating a bookmark from the malicious media file playing, resulting in a crash, overwriting ECX register.

While the evil .mp3 is playing, you go Playback > Bookmarks > Manage bookmarks > Create.

--------------------------------------------------------------------------------

(e48.10fc): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=039fe008 ebx=00001200 ecx=41414141 edx=03b7ab88 esi=039fe000 edi=004d0000 eip=7c911895 esp=04befcd8 ebp=04befcf0 iopl=0 nv up ei ng nz ac po cy cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010293 ntdll!RtlInitializeCriticalSection+0x298: 7c911895 8901 mov dword ptr [ecx],eax ds:0023:41414141=????????
--------------------------------------------------------------------------------

Vendor

VideoLAN team - <http://www.videolan.org>

Affected Version

1.0.5 Goldeneye

Tested On

Microsoft Windows XP Professional SP3 (English)

Vendor Status

[05.03.2010] Vendor has some knowledge of the issue.

PoC

vlcplayer_bof.txt
aimp2_evil.mp3

Credits

Vulnerability discovered by Gjoko Krstic - <[email protected]>

References

[1] <http://secunia.com/advisories/38853>
[2] <http://securityreason.com/exploitalert/7891>
[3] <http://www.securityfocus.com/bid/38569>
[4] <http://www.packetstormsecurity.org/filedesc/vlcmediaplayer-overflow.txt.html>
[5] <http://osvdb.org/62728>
[6] <http://www.juniper.net/security/auto/vulnerabilities/vuln38569.html>
[7] <https://vulners.com/cve/CVE-2011-1087>
[8] <https://nvd.nist.gov/vuln/detail/CVE-2011-1087>

Changelog

[05.03.2010] - Initial release
[06.03.2010] - Added reference [1], [2], [3], [4] and [5]
[07.03.2010] - Added reference [6]
[25.10.2021] - Added reference [7] and [8]

Contact

Zero Science Lab

Web: <http://www.zeroscience.mk>
e-mail: [email protected]

<html><body><p>VLC media player 1.0.5 Goldeneye (bookmarks) Remote Buffer Overflow PoC



Advisory: http://zeroscience.mk/en/vulnerabilities/ZSL-2010-4931.php

Summary: VLC media player is a highly portable multimedia player
         and multimedia framework  capable of reading most audio
         and video formats (MPEG-2, MPEG-4, H.264, DivX, MPEG-1,
         mp3, ogg, aac ...) as well as DVDs, Audio CDs VCDs, and
         various streaming protocols.


Description: VLC media player is vulnerable to a buffer overflow
             attack when processing .mp3 file and its metadata.
             It fails to perform boundry checks when creating a
             bookmark from the malicious media file playing,
	     resulting in a crash, overwriting ECX register.

	     While the evil .mp3 is playing, you go Playback &gt;
	     Bookmarks &gt; Manage bookmarks &gt; Create.

Tested on Microsoft Windows XP Professional SP3 (EN)

Version affected: 1.0.5 Goldeneye

Product web page: http://www.videolan.org

Vendor: VideoLAN team


-------------------------------------------------------------------------

(e48.10fc): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=039fe008 ebx=00001200 ecx=41414141 edx=03b7ab88 esi=039fe000 edi=004d0000
eip=7c911895 esp=04befcd8 ebp=04befcf0 iopl=0         nv up ei ng nz ac po cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010293
ntdll!RtlInitializeCriticalSection+0x298:
7c911895 8901            mov     dword ptr [ecx],eax  ds:0023:41414141=????????

-------------------------------------------------------------------------



Vulnerability discovered by Gjoko 'LiquidWorm' Krstic

liquidworm gmail com

Zero Science Lab - http://www.zeroscience.mk

28.02.2010




PoC:
	
		 http://zeroscience.mk/codes/aimp2_evil.mp3
	
	[mirror] http://milw0rm.com/sploits/2009-aimp2_evil.mp3
	[mirror] http://securityreason.com/download/11/13




//EOF</p></body></html>