Open Cubic Player (OCP) is "an open source music player started in the far 1994 but still used and supported". The Open Cubic Player suffers from multiple vulnerabilities that allows attackers to overflow internal buffers, causing it to execute arbitrary code.
Vulnerable Systems:
* Open Cubic Player version 2.6.0pre6 and prior (DOS/Windows)
* Open Cubic Player version 0.1.10_rc5 and prior (Linux/*BSD)
The programs (both the original source and its *nix fork) are affected by the following vulnerabilities: Buffer-overflow in mpLoadS3M
Buffer-overflow caused by the reading of an huge amount of data (orders and the other values have a signed type so a negative value like -1 is the same of 0xffffffff, and naturally is possible to use also positive number of max 32767) in buffers of only 256 elements.
From playgmd/gmdls3m.cpp: extern "C" int mpLoadS3M(gmdmodule &m, binfile &file)
...
struct
...
short orders,ins,pats,flags,cwt,ffv;
...
m.patnum=hdr.orders;
...
unsigned char orders[256];
unsigned short inspara[256];
unsigned short patpara[256];
unsigned long smppara[256];
unsigned char defpan[32];
file.read(orders, m.patnum);
...
Buffer-overflow in itload.cpp
From playit/itload.cpp: int itplayerclass::module::load(binfile &file)
...
unsigned short nords;
unsigned short nins;
unsigned short nsmps;
unsigned short npats;
...
unsigned char ords[256];
unsigned long sampoff[100];
unsigned long insoff[100];
unsigned long patoff[200];
Buffer-overflow in mpLoadULT
From playgmd/gmdlult.cpp: extern "C" int mpLoadULT(gmdmodule &m, binfile &file)
...
unsigned char chnn;
unsigned char patn;
chnn=file.getc();
patn=file.getc();
m.channum=chnn+1;
unsigned char panpos[32];
if (ver>=2)
file.read(panpos, m.channum);
...
Bouble buffer-overflow in mpLoadAMS
Here exist two vulnerabilities, the first one happens during the reading of the data array in the envs structure. data is an array of 64*3 bytes but the program allows the reading of 255*3 bytes causing a buffer-overflow. The second vulnerability instead happens during the reading of the name of each pattern where patname is a buffer of only 11 bytes that must containing the attacker's data which can reach a length of 255 bytes.
.jpg)
