Zoom Player Pro Malformed MIDI File Integer Overflow Vulnerability

Bugtraq ID:	36347
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 10 2009 12:00AM
Updated:	Sep 14 2009 07:21PM
Credit:	Dr_IDE
Vulnerable:	Inmatrix Zoom Player Pro 6.0 Inmatrix Zoom Player Pro 5.2
Not Vulnerable:

Zoom Player Pro Malformed MIDI File Integer Overflow Vulnerability

Zoom Player is prone to an integer overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

An attacker can exploit this issue to execute arbitrary code with the privileges of the user running the affected application or to crash the application, denying further service to legitimate users.

Zoom Player Pro 5.0.2 and 6.0.0 are vulnerable; other versions may also be affected.

Zoom Player Pro Malformed MIDI File Integer Overflow Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to open a malicious file using the affected application.

The following proof of concept is available:

• /data/vulnerabilities/exploits/36347.py

Zoom Player Pro Malformed MIDI File Integer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Zoom Player Pro Malformed MIDI File Integer Overflow Vulnerability

References:

• Zoom Player Pro Homepage (Inmatrix)