ALLPlayer '.wav' File Processing Memory Corruption Vulnerability

Bugtraq ID:	67436
Class:	Unknown
CVE:	CVE-2014-3736
Remote:	Yes
Local:	No
Published:	May 16 2014 12:00AM
Updated:	May 16 2014 12:00AM
Credit:	Aryan Bayaninejad
Vulnerable:
Not Vulnerable:

ALLPlayer '.wav' File Processing Memory Corruption Vulnerability

ALLPlayer is prone to a memory-corruption vulnerability.

An attacker can leverage this issue to crash the affected application, causing a denial-of-service condition. Due to the nature of this issue, arbitrary code execution may be possible but this has not been confirmed.

ALLPlayer 5.9 is vulnerable; other versions may also be affected.

ALLPlayer '.wav' File Processing Memory Corruption Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to open a specially crafted file with the affected application.

The following proof-of-concept is available:

• /data/vulnerabilities/exploits/67436.py

ALLPlayer '.wav' File Processing Memory Corruption Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

ALLPlayer '.wav' File Processing Memory Corruption Vulnerability

References: