Quinnware Quintessential Player Playlist Files Remote Memory Corruption Vulnerability

Bugtraq ID:	21331
Class:	Boundary Condition Error
CVE:	CVE-2006-6261
Remote:	Yes
Local:	No
Published:	Nov 28 2006 12:00AM
Updated:	Mar 09 2007 05:25PM
Credit:	Greg Linares is credited with the discovery of this vulnerability.
Vulnerable:	Quinnware Quintessential Player 4.50.1 .82
Not Vulnerable:

Quinnware Quintessential Player Playlist Files Remote Memory Corruption Vulnerability

Quinnware Quintessential Player is prone to a remote memory-corruption vulnerability because the application fails to handle malformed playlist files.

An attacker can exploit this issue to execute arbitrary code within the context of the application or trigger a denial-of-service condition.

Quintessential Player version 4.50.1.82 is vulnerable to this issue; other versions may also be affected.

Quinnware Quintessential Player Playlist Files Remote Memory Corruption Vulnerability

The following proof-of-concept exploit code is available:

• /data/vulnerabilities/exploits/21331.c
• /data/vulnerabilities/exploits/21331shinnai.pl

Quinnware Quintessential Player Playlist Files Remote Memory Corruption Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

Quinnware Quintessential Player Playlist Files Remote Memory Corruption Vulnerability

References:

• Quintessential Player Home Page (Quinnware)