full-disclosure - Arbitrary files overwriting through skins in DivX Player 2.6

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050121190234.301ec76b.aluigi@autistici.org>
From: aluigi at autistici.org (Luigi Auriemma)
Subject: Arbitrary files overwriting through skins in DivX
	Player 2.6


#######################################################################

                             Luigi Auriemma

Application:  DivX Player
              http://www.divx.com/divx/player/
Versions:     <= 2.6
Platforms:    Windows
Bug:          arbitrary files overwriting through skins
Exploitation: local (or remote through browser)
Date:         21 Jan 2005
Author:       Luigi Auriemma
              e-mail: aluigi@...istici.org
              web:    http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


As the name suggests, DivX Player is a Windows player for DivX files.
It is included by default in the DivX codec distribuited by
DivXNetworks.


#######################################################################

======
2) Bug
======


The skins used by DivX Player are zip files containing all the needed 
images and a script file.

When the player loads a skin, it unpacks the zip into a folder with the
same name of the DPS file located in the temporary system directory.

An attacker can overwrite the files on the victim's disk in which is
located the temporary folder (usually c:) using the classical directory
traversal path like:

  ..\..\..\..\windows\notepad.exe

Can be used both slash and backslash.


#######################################################################

===========
3) The Code
===========


  http://aluigi.altervista.org/poc/divxplayerbug.dps

It overwrites/creates the file c:\folder\divxplayerbug.txt

However creating the zip files to exploit the vulnerability is very
easy since you need only to modify the names of the files located in
the central directory of the zip file (the final part).


#######################################################################

======
4) Fix
======


No fix.
No reply from the vendor.


#######################################################################


--- 
Luigi Auriemma
http://aluigi.altervista.org