Winamp 5.5.8.2985 – Multiple Buffer Overflows

• Exploit Database
• 15 阅读

• 作者： Luigi Auriemma
  日期： 2010-10-13
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/15248/

• Source: http://aluigi.org/adv/winamp_1-adv.txt
  #######################################################################
  
   Luigi Auriemma
  
  Application:Winamp
  http://www.winamp.com
  Versions: <= 5.5.8.2985 (aka v5.581)
  Platforms:Windows
  Bugs: A] integer overflow in in_mkv
  B] integer overflow in in_nsv
  C] integer overflow in in_midi
  D] buffer-overflow in in_mod
  Exploitation: remote, versus server
  Date: 13 Oct 2010
  Author: Luigi Auriemma
  e-mail: aluigi@autistici.org
  web:aluigi.org
  
  
  #######################################################################
  
  
  1) Introduction
  2) Bugs
  3) The Code
  4) Fix
  
  
  #######################################################################
  
  ===============
  1) Introduction
  ===============
  
  
  Winamp is one of the most diffused and appreciated media players for
  Windows.
  
  
  #######################################################################
  
  =======
  2) Bugs
  =======
  
  -----------------------------
  A] integer overflow in in_mkv
  -----------------------------
  
  The in_mkv plugin uses a particular function (address 077078c0) for
  reading text strings from the Matroska containers.
  The operations performed are the reading of the ebml numeric value
  (64bit), the allocation of memory corresponding to that value (32bit)
  plus 1 and the subsequent reading of the data from the file leading to
  possible code execution:
  
  buff = malloc(size + 1);
  if(buff) fread(buff, 1, size, fd);
  
  
  -----------------------------
  B] integer overflow in in_nsv
  -----------------------------
  
  The in_nsv plugin is affected by an heap-overflow caused by the
  function (address 077ca422) that first verifies the size of the
  metadata string contained in the file adding 1 to it and then copies
  0x1fffffff bytes in a heap buffer leading to possible code execution
  (077C8577 CALL DWORD PTR DS:[EAX+8]):
  
  memcpy(heap_buffer, attacker_data, size >> 3);
  
  
  ------------------------------
  C] integer overflow in in_midi
  ------------------------------
  
  The in_midi plugin is affected by an heap overflow during the handling
  of the hmp files (a format used in some old DOS games) where a
  variable-length 32bit value is used for the copying of data with
  memcpy() from the attacker's data to a heap buffer which has not been
  reallocated for matching the needed size due to an integer overflow.
  Doesn't seem possible to control the code execution.
  
  
  ----------------------------
  D] buffer-overflow in in_mod
  ----------------------------
  
  The in_mod plugin is affected by a stack overflow which happens during
  the handling of a malformed MTM file but it's required that the user
  manually clicks on the player for visualizing the detailed informations
  of the track.
  
  
  #######################################################################
  
  ===========
  3) The Code
  ===========
  
  
  http://aluigi.org/poc/winamp_1.zip
  https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15248.zip (winamp_1_13Oct10.zip)
  
  
  #######################################################################
  
  ======
  4) Fix
  ======
  
  
  No fix.
  
  
  #######################################################################