A remotely exploitable buffer overflow vulnerability was found in MPlayer. A malicious host can craft a harmful ASX header, and trick MPlayer into executing arbitrary code upon parsing that header.
Credit:
The information has been provided by Otero, Hernan.
Vulnerable systems:
* MPlayer 0.90pre series
* MPlayer 0.90rc series
* MPlayer 0.90
* MPlayer 0.91
* MPlayer 1.0pre1
Immune systems:
* MPlayer releases before 0.90pre1
* MPlayer 0.92
* MPlayer HEAD CVS
In the source tree there is a file called asf_streaming.c this file has a function named asf_http_request, that function has two buffer overflows, this overflows are in the sprintf lines.
asf_http_request {
char str[250];
....
...
..
sprintf( str, "Host: %s:%d", server_url->hostname,
server_url->port );
....
...
..
sprintf( str, "Host: %s:%d", url->hostname, url->port );
....
...
..
}
This, at a first look, may look as it can?t be exploited ( because the MAXHOSTLEN size restriction ), however, if in an ASX file like this with a "badsite" listening in "badport" send "\n\n" as answer you could lead to a fully controllable EIP buffer overflow.
Patch availability:
A patch is available for all vulnerable versions here.
Exploit:
<asx version = "3.0">
<title>Bas Site ASX</title>
