vendor:
HDTV Player Pro
by:
b33f, sinn3r
7,5
CVSS
HIGH
Buffer Overflow
119
CWE
Product Name: HDTV Player Pro
Affected Version From: BlazeVideo HDTV Player Pro v6.6.0.3
Affected Version To: BlazeVideo HDTV Player Pro v6.6.0.3
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Windows 7 SP1/SP0, Windows XP SP3 / Windows Vista SP2/SP1/SP0
2012
BlazeVideo HDTV Player Pro v6.6 Filename Handling Vulnerability
This module exploits a vulnerability found in BlazeVideo HDTV Player's filename handling routine. When supplying a string of input data embedded in a .plf file, the MediaPlayerCtrl.dll component will try to extract a filename by using PathFindFileNameA(), and then copies whatever the return value is on the stack by using an inline strcpy. As a result, if this input data is long enough, it can cause a stack-based buffer overflow, which may lead to arbitrary code execution under the context of the user.
Mitigation:
N/A
