BugTraq
Media Player Classic .MPA Div-By-Zero Denial of Service Vulnerability May 14 2007 09:49PM
Michal Bucko (hackpl) (sapheal hack pl) (1 replies)
Re: Media Player Classic .MPA Div-By-Zero Denial of Service Vulnerability May 16 2007 03:31PM
3APA3A (3APA3A SECURITY NNOV RU) (1 replies)
Re: Media Player Classic .MPA Div-By-Zero Denial of Service Vulnerability May 16 2007 03:53PM
Michal Bucko (hackpl) (sapheal hack pl)
Dear 3APA3A,

In my opinion, You are only partially right. It is true that not all
of the bugs are security-related ones. It is, however, untrue that
the problem iself is only limited to media file playing refusal as
it leads to a crash. I don't see much security impact, too.
According to SecurityFocus (BID: 23991),
"[..] Media Player Classic is prone to a denial-of-service vulnerability
when processing a malformed MPA file. A remote attacker can
exploit this issue to crash the affected application, denying service
to legitimate users.[..]"

The issue is definetely not a conversation piece, I agree ;-)

Michal

----- Original Message -----
From: "3APA3A" <3APA3A (at) SECURITY.NNOV (dot) RU [email concealed]>
To: "Michal Bucko (hackpl)" <sapheal (at) hack (dot) pl [email concealed]>
Cc: <bugtraq (at) securityfocus (dot) com [email concealed]>
Sent: Wednesday, May 16, 2007 5:31 PM
Subject: Re: Media Player Classic .MPA Div-By-Zero Denial of Service
Vulnerability

> Dear Michal Bucko (hackpl),
>
> DoS against e.g. Internet Explorer may be treated as a vulnerability,
> because all windows are closed and user can loose some useful
> information. This is very low impact, but it is. In this case I see no
> impact at all. Resource consumption during dump file creation?
>
> Universal DoS against any media player:
>
> 1. Create new file in notepad
> 2. Type "Na!"
> 3. Save file as exploit.mp3
> 4. Open file in any media player.
> 5. Media player fails to play.
>
> Is it vulnerability? Guys, not any application bug is security one.
>
>
> --Tuesday, May 15, 2007, 1:49:54 AM, you wrote to
> bugtraq (at) securityfocus (dot) com [email concealed]:
>
>
> MBh> Media Player Classic fails to handle MPA-extension media files. When
> empty
> MBh> file provided Media Player
> MBh> Classic fails to properly parse MPA file format.
>
> MBh> 00634DD1 |. 8B4C24 18 MOV ECX,DWORD PTR SS:[ESP+18]
> MBh> 00634DD5 |. 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+14]
> MBh> 00634DD9 |. 33D2 XOR EDX,EDX
> MBh> 00634DDB |. F7F1 DIV ECX
>
> MBh> ECX 00000000
>
>
> --
> ~/ZARAZA http://securityvulns.com/
>
>

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus