Zortam MP3 Media Studio 9.40 Multiple Memory Corruption Vulnerabilities

Title: Zortam MP3 Media Studio 9.40 Multiple Memory Corruption Vulnerabilities
Advisory ID: ZSL-2009-4920
Type: Local/Remote
Impact: System Access, DoS
Risk: (3/5)
Release Date: 16.07.2009
Summary
Zortam Mp3 Media Studio is all-in-one Mp3 application that contains Mp3 ID3 Tag Organizer for searching and cataloguing Mp3 files into Mp3 library, editing ID3v1 and ID3v2.4 tags (ID3 Tag Editor-Mp3 Tag Editor), CD Ripper with album cover art/lyric support that uses CDDB (Internet Compact Disc Database) and automatically writes ID3v1 and ID3v2.4 tags.
Description
Zortam MP3 Studio version 9.40 suffers from a memory corruption attack from two different malicious files. The first method is thru a .mp3 file which has its ID3 tags filled with long strings. The second method is a .m3u list which is loaded in to the player resulting in memory corruption of the whole application including Dr.Watson crashing along with the app. For 1st method, you can click the Search Media for MP3's button and select the folder where the .mp3 file with the long ID3 tags is located. The 2nd method, load .m3u file into the MP3 Player.
Vendor
Zortam Corp. - http://www.zortam.com
Affected Version
9.40
Tested On
Microsoft Windows XP Professional SP3 (English)
Vendor Status
N/A
PoC
zortam_studio.pl
aimp2_evil.mp3
Credits
Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>
References
[1] http://packetstormsecurity.org/filedesc/zortam-memory.txt.html
[2] http://www.milw0rm.com/exploits/9169
[3] http://securityreason.com/exploitalert/6632
[4] http://zeroscience.mk/codes/aimp2_evil.mp3
[5] http://milw0rm.com/sploits/2009-aimp2_evil.mp3
[6] http://securityreason.com/download/11/13
[7] http://net-security.org/vuln.php?id=14077
Changelog
[16.07.2009] - Initial release
[15.10.2010] - Added reference [7]
Contact
Zero Science Lab

Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk