PT-2009-3649 · Ab Team · Bs.Player

His0K4 · Published 2009-03-24 · Updated 2018-10-10 · CVE-2009-1068

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions BS.Player versions 2.32 Build 975 through 2.34 Build 980 and earlier

Description The issue is a stack-based buffer overflow that can be triggered by a long hostname in a .bsl playlist file, potentially allowing remote attackers to cause a denial of service or execute arbitrary code.

Recommendations For versions 2.32 Build 975 through 2.34 Build 980 and earlier, consider avoiding the use of long hostnames in .bsl playlist files until a fix is available. As a temporary workaround, restrict the length of hostnames in .bsl files to prevent potential exploitation.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2009-1068

Affected Products

Bs.Player

References · 10

• 🔥 https://exploit-db.com/exploits/8249 · Exploit
• 🔥 https://exploit-db.com/exploits/8251 · Exploit
• 🔥 http://retrogod.altervista.org/9sg_bsplayer_seh.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-1068 · Security Note
• http://secunia.com/advisories/34412 · Vendor Advisory
• http://osvdb.org/52841 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49342 · Note
• http://vupen.com/english/advisories/2009/0800 · Note
• http://securityfocus.com/archive/1/502016/100/0/threaded · Note
• http://securityfocus.com/bid/34190 · Note