full-disclosure - Unicode buffer-overflow in Zoom Player 6.00b2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20071224184805.9261d5a4.aluigi@autistici.org>
Date: Mon, 24 Dec 2007 18:48:05 +0100
From: Luigi Auriemma <aluigi@...istici.org>
To: bugtraq@...urityfocus.com, bugs@...uritytracker.com,
	news@...uriteam.com, full-disclosure@...ts.grok.org.uk, vuln@...unia.com,
	packet@...ketstormsecurity.org
Subject: Unicode buffer-overflow in Zoom Player 6.00b2


#######################################################################

                             Luigi Auriemma

Application:  Zoom Player
              http://www.inmatrix.com
Versions:     <= v6.00 beta 2 and naturally all the stable v5 versions
Platforms:    Windows
Bug:          unicode buffer-overflow
Exploitation: local
Date:         24 Dec 2007
Author:       Luigi Auriemma
              e-mail: aluigi@...istici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Zoom Player is a media player for Windows which supports many formats
through external filters.


#######################################################################

======
2) Bug
======


Zoom Player is affected by an unicode buffer-overflow in the function
which builds the error messages.
The problem can be exploited for example through a malformed ZPL file
containing a http link to a file with PLS extension which will force
the program to use wsprintf for building the "Unable to play [%s]"
error message.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/zoomprayer.zpl


#######################################################################

======
4) Fix
======


The next beta will contain the fix.


#######################################################################


--- 
Luigi Auriemma
http://aluigi.org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/