[FD] Free WMA MP3 Converter - Buffer Overflow Exploit (SEH)

Document Title: =============== Free WMA MP3 Converter - Buffer Overflow Exploit (SEH) References (Source): ==================== http://ift.tt/1ODFhxf Release Date: ============= 2015-10-19 Vulnerability Laboratory ID (VL-ID): ==================================== 1620 Common Vulnerability Scoring System: ==================================== 7.5 Product & Service Introduction: =============================== Free WMA MP3 Converter is an free WMA to MP3 converter which helps you convert WMA to MP3, MP3 to WMA, WAV to MP3, WAV to WMA, MP3 to WAV, WMA to WAV etc. Free WMA MP3 Converter provides optimized default settings. No more thinking but just a click to start WMA to MP3 conversion with the MP3 converter! In addition, there are still a lot of settings can be set up to meet your special need. All the conversion process like convert WMA to MP3 and MP3 to WMA are fast and simple with adjustable output quality. The audio converter supports ID3 tag, the ID3 tags in the original files can be reserved after conversion. Free download the Free WMA MP3 Converter to enjoy your WMA and MP3 music anywhere and anytime! (Copy of the Product Homepage: http://ift.tt/1GnhqP3 ) Abstract Advisory Information: ============================== An independent vulnerability laboratory researcher discovered a buffer overflow vulnerability in the official Free WMA MP3 Converter v1.8 software. Vulnerability Disclosure Timeline: ================================== 2015-10-16: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== Exploitation Technique: ======================= Local Severity Level: =============== High Technical Details & Description: ================================ A local buffer overflow (SEH) software vulnerability has been discovered in the official Free WMA MP3 Converter v1.8 software. The vulnerability allows a local attacker to process the windows software by exploitation of a classic buffer overflow vulnerability. The security risk of the buffer overflow vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 7.5. Exploitation of the vulnerability requires a low privilege system user account and no user interaction. Successful exploitation of the local vulnerability results in system compromise by elevation of privileges via overwrite of the registers. Proof of Concept (PoC): ======================= #!/usr/bin/python #Free WMA MP3 Converter - Buffer Overflow Exploit (SEH) #Author : ZwX #Download: http://ift.tt/1GnhqP3 #Version : 1.8 #Tested Os : Windows 7 #Reference : http://ift.tt/1NB68o4 from struct import pack buffer = "\x41" * 4116 nseh = "\xeb\x06\xff\xff" seh = pack("

Source: Gmail -> IFTTT-> Blogger