0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Format Factory v2.95 - Buffer Overflow Vulnerabilities
[Title: ====== Format Factory v2.95 - Buffer Overflow Vulnerabilities Introduction: ============= Format Factory is a multifunctional media converter. Provides functions below ... - All to MP4/3GP/MPG/AVI/WMV/FLV/SWF. - All to MP3/WMA/AMR/OGG/AAC/WAV. - All to JPG/BMP/PNG/TIF/ICO/GIF/TGA. - Rip DVD to video file , Rip Music CD to audio file. - MP4 files support iPod/iPhone/PSP/BlackBerry format. - Supports RMVB,Watermark, AV Mux. Format Factory`s Feature: - support converting all popular video,audio,picture formats to others. - Repair damaged video and audio file. - Reducing Multimedia file size. - Support iphone,ipod multimedia file formats. - Picture converting supports Zoom,Rotate/Flip,tags. - DVD Ripper. - Supports 60 languages - All Windows OS (Copy of the Vendor Homepage: http://www.formatoz.com ) Details: ======== 1.1 A Buffer Overflow vulnerability is detected in Format Factory v2.95 Software. The vulnerability allows an local attacker to overwrite the ecx & eip to control the affected vulnerable process. Successful exploitation can result is privilege escalation with system access rights of the affected vulnerable software process. The vulnerability is located on the Custom Profile module when processing to add a file. Vulnerable Module(s): [+] Custom Profile - File Add --- Error Report (System) --- Version=1 EventType=BEX EventTime=129801306605752827 ReportType=2 Consent=1 ReportIdentifier=0140e860-918d-11e1-ba1b-a7b309768cde IntegratorReportIdentifier=0140e85f-918d-11e1-ba1b-a7b309768cde WOW64=1 Response.type=4 Sig[0].Name=Anwendungsname Sig[0].Value=FormatFactory.exe Sig[1].Name=Anwendungsversion Sig[1].Value=2.95.0.0 Sig[2].Name=Anwendungszeitstempel Sig[2].Value=4f848c41 Sig[3].Name=Fehlermodulname Sig[3].Value=StackHash_059a Sig[4].Name=Fehlermodulversion Sig[4].Value=0.0.0.0 Sig[5].Name=Fehlermodulzeitstempel Sig[5].Value=00000000 Sig[6].Name=Ausnahmeoffset Sig[6].Value=00410041 <= ecx overwritten Sig[7].Name=Ausnahmecode Sig[7].Value=c0000005 Sig[8].Name=Ausnahmedaten ... & EventType=APPCRASH EventTime=129801310355837320 ReportType=2 Consent=1 ReportIdentifier=e0c79250-918d-11e1-ba1b-a7b309768cde IntegratorReportIdentifier=e0c7924f-918d-11e1-ba1b-a7b309768cde WOW64=1 Response.type=4 Sig[0].Name=Anwendungsname Sig[0].Value=FormatFactory.exe Sig[1].Name=Anwendungsversion Sig[1].Value=2.95.0.0 Sig[2].Name=Anwendungszeitstempel Sig[2].Value=4f848c41 Sig[3].Name=Fehlermodulname Sig[3].Value=FormatFactory.exe Sig[4].Name=Fehlermodulversion Sig[4].Value=2.95.0.0 Sig[5].Name=Fehlermodulzeitstempel Sig[5].Value=4f848c41 Sig[6].Name=Ausnahmecode Sig[6].Value=c0000005 Sig[7].Name=Ausnahmeoffset Sig[7].Value=00008f53 1.2 A Buffer Overflow vulnerability is detected in Format Factory v2.95 Software. The Buffer Overflow Vulnerability is located when processing to load large file names. Successful exploitation results in a local null ptr buffer overflow. Attackers can form or load files (local) large names or extension name to crash the software stable when processing to save the input. The vulnerability did not allow to overwrite any registers of the affected vulnerable process. --- Error Report (System) --- Problem Event Name: BEX Application Name: FormatFactory.exe Application Version: 2.60.0.0 Application Timestamp: 4cd197df Fault Module Name: MSVCR100.dll Fault Module Version: 10.0.30319.1 Fault Module Timestamp: 4ba1dbbe Exception Offset: 0008ae6e Exception Code: c0000417 Exception Data: 00000000 OS Version: 6.1.7600.2.0.0.256.1 Locale ID: 1033 Additional Information 1: e07f Additional Information 2: e07f7afc2abe4439f8a8f96d499e3027 Additional Information 3: 5154 Additional Information 4: 515482f92719c2dc6fc04ebc97d28463 1.3 A Buffer Overflow vulnerability is detected in Format Factory v2.95 Software. The Buffer Overflow Vulnerability is located in the *.ini configuration file when processing to load the maxwidth size. Local attackers can implement or replace the ini settings to overwrite the EIP register. Successful exploitation can result is privilege escalation with system access rights of the affected vulnerable software process. Vulnerable Module(s): [+] INI - Width & Height - Size & Buffer Validation --- Error Report (System) --- EventType=BEX EventTime=129801380523760695 ReportType=2 Consent=1 ReportIdentifier=371c0b8c-919e-11e1-ba1b-a7b309768cde IntegratorReportIdentifier=371c0b8b-919e-11e1-ba1b-a7b309768cde WOW64=1 Response.type=4 Sig[0].Name=Anwendungsname Sig[0].Value=FormatFactory.exe Sig[1].Name=Anwendungsversion Sig[1].Value=2.95.0.0 Sig[2].Name=Anwendungszeitstempel Sig[2].Value=4f848c41 Sig[3].Name=Fehlermodulname Sig[3].Value=StackHash_059a Sig[4].Name=Fehlermodulversion Sig[4].Value=0.0.0.0 Sig[5].Name=Fehlermodulzeitstempel Sig[5].Value=00000000 Sig[6].Name=Ausnahmeoffset Sig[6].Value=41414141 <= overwritten register EIP Sig[7].Name=Ausnahmecode Sig[7].Value=c0000005 Sig[8].Name=Ausnahmedaten Sig[8].Value=00000008 DynamicSig[1].Name=Betriebsystemversion DynamicSig[1].Value=6.1.7601.2.1.0.768.3 DynamicSig[2].Name=Gebietsschema-ID DynamicSig[2].Value=1031 DynamicSig[22].Name=Zusatzinformation 1 DynamicSig[22].Value=059a DynamicSig[23].Name=Zusatzinformation 2 DynamicSig[23].Value=059a393e1c4f8097b3d5573aa130c733 DynamicSig[24].Name=Zusatzinformation 3 DynamicSig[24].Value=563a DynamicSig[25].Name=Zusatzinformation 4 DynamicSig[25].Value=563a7086139512fa1af4651c2e9f9f50 # 0day.today [2024-11-16] #