[NT] dBpowerAMP Auxiliary Arbitrary Command Execution
SecuriTeam <[email protected]>
| Newsgroups | gmane.comp.security.securiteam |
|---|---|
| Message-ID | <[email protected]> |
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source. http://www.securiteam.com/mailinglist.html - - - - - - - - - dBpowerAMP Auxiliary Arbitrary Command Execution ------------------------------------------------------------------------ SUMMARY <http://www.dbpoweramp.com> dMC Auxiliary Input is "used to record audio to your hard drive from what is being played through your soundcard. Applications include transferring cassettes or vinyl to your pc for further processing and perhaps for burning to audio cd, capturing streaming audio which cannot be downloaded and converting the audio from encrypted files (which you can play however) which cannot be converted otherwise by dMC". A full path "%windir%\system32" is not specified in dBpowerAMP whenever it tries to launch the sndvol32.exe program. This is allows a malicious local user to cause the execution of another program beside sndvol32.exe whenever a user tries to use the program, this without his knowledge. DETAILS Vulnerable Systems: * dBpowerAMP version 6.0.0.1 Proof of concept: 1) Copy your cmd.exe in your dBpowerAMP path and rename it to: sndvol32.exe 2) Then execute auxiliary.exe >> Options >> Input Source >> Click on "Select" 3) The launched process is our cmd.exe and not the "Windows Volume Control". ADDITIONAL INFORMATION The information has been provided by <mailto:[email protected]> SecuBox fRoGGz. ======================================== This bulletin is sent to members of the SecuriTeam mailing list. To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] In order to subscribe to the mailing list, simply forward this email to: [email protected] ==================== ==================== DISCLAIMER: The information in this bulletin is provided "AS IS" without warranty of any kind. In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.