Illustrate dBpowerAMP Music Converter and Audio Player Buffer Overflow Vulnerabilities

Bugtraq ID:	11266
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 28 2004 12:00AM
Updated:	Sep 28 2004 12:00AM
Credit:	Discovery is credited to James Bercegay of the GulfTech Security Research Team.
Vulnerable:	Illustrate dbPowerAmp Music Converter 11.5 Illustrate dbPowerAmp Music Converter 11.1 Illustrate dbPowerAmp Music Converter 11.0 Illustrate dbPowerAmp Music Converter 10.1 Illustrate dbPowerAmp Music Converter 10.0 Illustrate dBpowerAMP Audio Player 2.0
Not Vulnerable:

Illustrate dBpowerAMP Music Converter and Audio Player Buffer Overflow Vulnerabilities

dBpowerAMP Music Converter and Audio Player reported prone to remote buffer overflow vulnerabilities when processing malformed audio and playlist files. This issues exists due to insufficient boundary checks performed by the applications and may allow an attacker to gain unauthorized access to a vulnerable computer.

Illustrate dBpowerAMP Music Converter and Audio Player Buffer Overflow Vulnerabilities

The following proof of concept is available:
[playlist]
NumberOfEntries=1
File1=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBBB

Exploit code has been provided by fRoGGz.

• /data/vulnerabilities/exploits/dMCShell_bof.c

Illustrate dBpowerAMP Music Converter and Audio Player Buffer Overflow Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Illustrate dBpowerAMP Music Converter and Audio Player Buffer Overflow Vulnerabilities

References:

• dBpowerAMP Audio Player Homepage (Illustrate)