SDP Downloader 'ASX' File Heap Buffer Overflow Vulnerability
BID:34712
Info
SDP Downloader 'ASX' File Heap Buffer Overflow Vulnerability
| Bugtraq ID: | 34712 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 24 2009 12:00AM |
| Updated: | Jun 08 2009 08:49PM |
| Credit: | Cyber-Zone |
| Vulnerable: |
SDP Multimedia SDP Downloader 2.3 |
| Not Vulnerable: | |
Discussion
SDP Downloader 'ASX' File Heap Buffer Overflow Vulnerability
SDP Downloader is prone to a heap-based buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.
Attackers can execute arbitrary code in the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.
SDP Downloader 2.3.0 is vulnerable; other versions may also be affected.
SDP Downloader is prone to a heap-based buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.
Attackers can execute arbitrary code in the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.
SDP Downloader 2.3.0 is vulnerable; other versions may also be affected.
Exploit / POC
SDP Downloader 'ASX' File Heap Buffer Overflow Vulnerability
An attacker can exploit this issue by enticing an unsuspecting victim to open a malicious file using the affected application.
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
The following exploits and proof of concept are available:
An attacker can exploit this issue by enticing an unsuspecting victim to open a malicious file using the affected application.
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
The following exploits and proof of concept are available:
Solution / Fix
SDP Downloader 'ASX' File Heap Buffer Overflow Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
SDP Downloader 'ASX' File Heap Buffer Overflow Vulnerability
References:
References:
- SDP Downloader Homepage (SDP Multimedia)