FoxMediaTools FoxPlayer '.m3u' File Buffer Overflow Vulnerability

Bugtraq ID:	38127
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 05 2010 12:00AM
Updated:	Nov 29 2010 06:55PM
Credit:	cr4wl3r
Vulnerable:	FoxMediaTools FoxPlayer 2.4 FoxMediaTools FoxPlayer 2.3 FoxMediaTools FoxPlayer 1.7 FoxMediaTools FoxPlayer 1.1 FoxMediaTools FoxPlayer 2.0
Not Vulnerable:

FoxMediaTools FoxPlayer '.m3u' File Buffer Overflow Vulnerability

FoxMediaTools FoxPlayer is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

FoxPlayer 1.7.0 and 2.4.0 are vulnerable; other versions may also be affected.

FoxMediaTools FoxPlayer '.m3u' File Buffer Overflow Vulnerability

The following exploit and proof-of-concept code are available:

• /data/vulnerabilities/exploits/38127.pl
• /data/vulnerabilities/exploits/38127-1.pl
• /data/vulnerabilities/exploits/38127-2.pl
• /data/vulnerabilities/exploits/38127-3.pl

FoxMediaTools FoxPlayer '.m3u' File Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

FoxMediaTools FoxPlayer '.m3u' File Buffer Overflow Vulnerability

References:

• FoxPlayer Homepage (FoxMediaTools)