CVE-2012-0003

Related Files

Analysis Of A MIDI Remote Code Execution Vulnerability

Posted Feb 5, 2012

Authored by Celil Unuver

This whitepaper analyzes the MIDI remote code execution vulnerability found in the Windows Multimedia Library. Written in Turkish.

tags | paper, remote, code execution

systems | windows

advisories | CVE-2012-0003

SHA-256 | bc77e719e2e51fcf4b4ae803f613a643621f8d598b8d91904c9c989f3d76fdee

Download | Favorite | View

MS12-004 midiOutPlayNextPolyEvent Heap Overflow

Posted Jan 28, 2012

Authored by sinn3r, juan vazquez, Shane Garrett | Site metasploit.com

This Metasploit module exploits a heap overflow vulnerability in the Windows Multimedia Library (winmm.dll). The vulnerability occurs when parsing specially crafted MIDI files. Remote code execution can be achieved by using Windows Media Player's ActiveX control. Exploitation is done by supplying a specially crafted MIDI file with specific events, causing the offset calculation being higher than how much is available on the heap (0x400 allocated by WINMM!winmmAlloc), and then allowing us to either "inc al" or "dec al" a byte. This can be used to corrupt an array (CImplAry) we setup, and force the browser to confuse types from tagVARIANT objects, which leverages remote code execution under the context of the user. At this time, for IE 8 target, JRE (Java Runtime Environment) is required to bypass DEP (Data Execution Prevention). Note: Based on our testing, the vulnerability does not seem to trigger when the victim machine is operated via rdesktop.

tags | exploit, java, remote, overflow, code execution, activex

systems | windows

advisories | CVE-2012-0003, OSVDB-78210

SHA-256 | 2fdc9c5c7f7d444b003b94e6d9ac9413e9711bc63c367b5bb555b0a3a0fecd1c

Download | Favorite | View