Secunia CSI7
Advisories
Research
Forums
Create Profile
Our Commitment
Database
Search
Advisories by Product
Advisories by Vendor
Terminology
Report Vulnerability
Insecure Library Loading
Highly critical

Media Player Classic AVI File Processing Buffer Overflow

-

Release Date:  2007-09-13    Last Update:  2007-11-20    Views:  25,872

Secunia Advisory SA26806

Where:

From remote

Impact:

System access

Solution Status:

Unpatched

CVE Reference(s):

Description


Code Audit Labs has discovered a vulnerability in Media Player Classic, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to an input validation error when processing .AVI files and can be exploited to cause a buffer overflow via a .AVI file with a specially crafted "indx" chunk.

Successful exploitation allows execution of arbitrary code.

The vulnerability is confirmed in version 6.4.9.0. Other versions may also be affected.


Solution:
The original version is no longer maintained and an official fix is not available.

Provided and/or discovered by:
Code Audit Labs

Original Advisory:
http://www.vulnhunt.com/advisories/CAL-20070912-1_Multiple_vendor_produce_handling_AVI_file_vulnerabilities.txt

Deep Links:
Links available to Secunia VIM customers

Do you have additional information related to this advisory?

Please provide information about patches, mitigating factors, new versions, exploits, faulty patches, links, and other relevant data by posting comments to this Advisory. You can also send this information to vuln@secunia.com

Subject: Media Player Classic AVI File Processing Buffer Overflow

User Message
cyberquotient RE: Media Player Classic AVI File Processing Buffer Overflow
Member 2nd Mar, 2010 04:52
Score: 0
Posts: 11
User Since: 24th Feb 2010
System Score: N/A
Location: US
Last edited on 2nd Mar, 2010 04:53
There is a later version of Media Player Classic than the one identified in this vulnerability - 6.4.9.1. The latest version of QuickTime Alternative (3.1.1) bundles that version. Is this vulnerability confirmed there?
Was this reply relevant?
+2
-0
M.Hansen RE: Media Player Classic AVI File Processing Buffer Overflow
Secunia Official 2nd Mar, 2010 08:27
Score: 188
Posts: 406
User Since: 26th Jan 2009
System Score: N/A
Location: Copenhagen, DK
Hi
The original creators of Media Player Classic has disbanded the project and Media Player Classic is now End-Of-Life.

There is however a new project based on Media Player Classic called Media Player Classic Home Cinema which is still supported.

cyberquotient

RE: Media Player Classic AVI File Processing Buffer Overflow
[+]
This reply has been minimised due to a negative Relevancy Score.

-

You must be logged in to post a comment.



 Products Solutions Customers Partner Resources Company
 
 Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)
 Industry
Compliance
Technology
Integration
 Customers
Testimonials
 VARS
MSSP
Technology Partners
References
 Factsheets
Reports
Webinars
Events
 About us
Careers
Memberships
Newsroom


 
© 2002-2014 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability