Two vulnerabilities have been discovered in Hero DVD Player, which can be exploited by malicious people to compromise a user's system.

1) A boundary error in the bundled Mplayer.exe when processing M3U files can be exploited to cause a heap-based buffer overflow via an M3U file containing an overly long entry.

Successful exploitation allows execution of arbitrary code, but requires that the user is tricked into loading a malicious M3U file.

2) A boundary error in HttpFile.dll when parsing a URL can be exploited to cause a stack-based buffer overflow via a specially crafted HTTP redirect response.

Successful exploitation allows execution of arbitrary code, but requires that the user is tricked into opening a malicious Http URL.

The vulnerabilities are confirmed in version 3.0.8. Other versions may also be affected.

Solution
Do not open untrusted M3U files or Http URL links using the application.

Provided and/or discovered by
1) Parvez Anwar
2) chap0

Changelog
Further details available in Customer Area

Original Advisory
chap0:
http://www.corelan.be:8800/index.php/forum/security-advisories/corelan-10-056-hero-dvd-remote-buffer-overflow-exploit/#p4215

Deep Links
Links available in Customer Area