Secunia

Multiple vulnerabilities have been discovered in BS.Player, which can be exploited by malicious people to compromise a user's system.

1) A boundary error when parsing BSI files can be exploited to cause a stack-based buffer overflow by e.g. tricking a user into opening a specially crafted BSI file containing an overly long "Skin" key in the "Options" section.

2) A boundary error in the processing of ID3 tags can be exploited to cause a stack-based buffer overflow e.g. when a user adds a specially crafted mp3 file to the media library.

These vulnerabilities are confirmed in version 2.51 build 1022 (Free Edition). Other versions may also be affected.

3) A boundary error when processing playlist entries can be exploited to cause a stack-based buffer overflow via a specially crafted M3U file.

This vulnerability is confirmed in version 2.57 build 1051 (Free Edition). Other versions may also be affected.

Solution
Do not open untrusted files.

Provided and/or discovered by
1) Mert SARICA
2) Gjoko Krstic
3) C4SS!0 G0M3S

Changelog
Further details available in Customer Area

Original Advisory
1) http://www.mertsarica.com/?p=511
2) http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4932.php

Deep Links
Links available in Customer Area