PT-2010-3629 · Ab Team · Bs.Player

Gjoko Krstic · Published 2010-05-21 · Updated 2010-05-24 · CVE-2010-2009

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions BS.Player versions 2.41 build 1003 through 2.51 build 1022

Description A stack-based buffer overflow issue exists in the media library of the affected software, allowing user-assisted remote attackers to execute arbitrary code via a long ID3 tag in a .MP3 file.

Recommendations For versions 2.41 build 1003 through 2.51 build 1022, consider disabling the media library functionality until a patch is available to prevent exploitation. Restrict access to .MP3 files with long ID3 tags to minimize the risk of arbitrary code execution.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2010-2009

Affected Products

Bs.Player

References · 5

• 🔥 http://securityfocus.com/bid/38568 · Exploit
• 🔥 http://zeroscience.mk/en/vulnerabilities/ZSL-2010-4932.php · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-2009 · Security Note
• http://secunia.com/advisories/38221 · Vendor Advisory
• http://packetstormsecurity.org/1003-advisories/bsplayerml-overflow.txt · Note