Serious Exploit in Windows Media Player (WMP)

The New Acunetix V12 Engine


Oh look! Another 0-day in Windows…this time in Media Player, there was a few in Word lately and the latest thing that just hit is an XSS flaw in PDF files online.

I’ll report more on those later.

The Windows Media Player library WMVCORE.DLL contains a potentially exploitable heap buffer overflow in its handling of “REF HREF” URLs within ASX files. If the URL contains an unrecognized protocol (only “file”, “ftp”, “http”, “https”, “mms”, “mmst”, “mmsu”, “rtsp”, “rtspt”, and “rtspu” appear to be recognized), the function at 7D7A8F27 in WMVCORE.DLL version 9.0.0.3250, and at 086E586E in WMVCORE.DLL version 10.0.0.3802, will create a copy of the string in which the protocol is replaced with “mms”. A heap buffer is allocated, the string “mms” is copied into it, and then everything after and including “://” in the “REF HREF” URL is concatenated using wcsncat.

So what out what you are streaming..please! Or alternatively use something decent like Winamp.

Unfortunately, the heap buffer for the new “mms” URL is allocated to the size of the “REF HREF” URL, and even more unfortunately, the length of the input string being passed to wcsncat is supplied as the character count, effectively causing wcsncat to behave identically to wcscat. As a result, a two- or four-byte heap overflow is possible if the “REF HREF” URL features a protocol shorter than three characters (the length of “mms”).

Single-letter protocols (such as “a://”) are rejected, but this restriction can be circumvented by encoding the protocol (“%61://”), thereby making a four-byte overflow possible.

Exploitability due to the corruption of the adjacent heap block’s header is assumed likely but research is ongoing.

As far as I know there’s no current exploit for this, but it is a possibility.

Source: eEye

Posted in: Exploits/Vulnerabilities, Windows Hacking

, , ,


Latest Posts:


Domained - Multi Tool Subdomain Enumeration Domained – Multi Tool Subdomain Enumeration
Domained is a multi tool subdomain enumeration tool that uses several subdomain enumeration tools and wordlists to create a unique list of subdomains.
Acunetix Vulnerability Scanner For Linux Now Available Acunetix Vulnerability Scanner For Linux Now Available
Acunetix Vulnerability Scanner For Linux is now available, now you get all of the functionality of Acunetix, with all of the dependability of Linux.
Gerix WiFi Cracker - Wireless 802.11 Hacking Tool With GUI Gerix WiFi Cracker – Wireless 802.11 Hacking Tool With GUI
Gerix WiFi cracker is an easy to use Wireless 802.11 Hacking Tool with a GUI, it was originally made to run on BackTrack and this version has been updated for Kali (2018.1).
Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.
Eraser - Windows Secure Erase Hard Drive Wiper Eraser – Windows Secure Erase Hard Drive Wiper
Eraser is a hard drive wiper for Windows which allows you to run a secure erase and completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.


One Response to Serious Exploit in Windows Media Player (WMP)

  1. Sypherknife June 5, 2007 at 12:41 pm #

    …”Or alternatively use something decent like Winamp.”

    If only people realised that there are alternatives to shit programs