A malformed mp3 file allows arbitrary code execution
Analyzes and adjusts the volume of MP3 files
Brought to you by:
snelg
Menu
▾
▴
1 Attachments
#36 A malformed mp3 file allows arbitrary code execution
Hi,
a buffer overflow in mp3gain 1.5.2 can be used to execute code using a malformed
mp3 file. A POC is attached. Running it inside gdb gives more information:
gdb --args mp3gain PoC.mp3
....
45% of 98432 bytes analyzed
Program received signal SIGSEGV, Segmentation fault.
0xf7e6830f in __GI_memcpy (dstpp=0xffffdfd5, srcpp=0x8464300, len=206) at memcpy.c:54
54 memcpy.c: No such file or directory.
(gdb) bt
0 0xf7e6830f in __GI_memcpy (dstpp=0xffffdfd5, srcpp=0x8464300, len=206) at memcpy.c:54
1 0x08054e2b in ?? ()
2 0x0805560b in ?? ()
3 0x0804ac83 in ?? ()
4 0x3bf3dcd6 in ?? ()
5 0x733f7dd5 in ?? ()
6 0x0b1ea714 in ?? ()
7 0x7294c782 in ?? ()
....
As you can see, the stack trace is smashed and the values come from the bytes in the input file.
We generated an exploit for this bug.
This report contains the information from the debian bug tracker: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=740268
(sorry that I forgot to escape the markdown in the pasted debugging information, i can't find how to edit it)
Last edit: g042 2014-03-10
mpglibDBL appears to be an old copy of mpglib from mpg123, and has the same security vulnerabilties.
These patches seem to fix the vulnerability:
However, I would recommend that mp3gain should use an externally-maintained MP3 decoding library rather than shipping its own.
Status?
Years later, finally updated mp3gain to use external libmpg123.
Just the linux source, no updates to the various Windows builds.