Title: Zortam MP3 Media Studio 9.40 Multiple Memory Corruption Vulnerabilities
Advisory ID: ZSL-2009-4920
Type: Local/Remote
Impact: System Access, DoS
Risk: (3/5)
Release Date: 16.07.2009

Summary

Zortam Mp3 Media Studio is all-in-one Mp3 application that contains Mp3 ID3 Tag Organizer for searching and cataloguing Mp3 files into Mp3 library, editing ID3v1 and ID3v2.4 tags (ID3 Tag Editor-Mp3 Tag Editor), CD Ripper with album cover art/lyric support that uses CDDB (Internet Compact Disc Database) and automatically writes ID3v1 and ID3v2.4 tags.

Description

Zortam MP3 Studio version 9.40 suffers from a memory corruption attack from two different malicious files. The first method is thru a .mp3 file which has its ID3 tags filled with long strings. The second method is a .m3u list which is loaded in to the player resulting in memory corruption of the whole application including Dr.Watson crashing along with the app. For 1st method, you can click the Search Media for MP3's button and select the folder where the .mp3 file with the long ID3 tags is located. The 2nd method, load .m3u file into the MP3 Player.

Vendor

Zortam Corp. - http://www.zortam.com

Affected Version

9.40

Tested On

Microsoft Windows XP Professional SP3 (English)

Vendor Status

N/A

PoC

zortam_studio.pl
aimp2_evil.mp3

Credits

Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>

References

[1] http://packetstormsecurity.org/filedesc/zortam-memory.txt.html
[2] http://www.milw0rm.com/exploits/9169
[3] http://securityreason.com/exploitalert/6632
[4] http://zeroscience.mk/codes/aimp2_evil.mp3
[5] http://milw0rm.com/sploits/2009-aimp2_evil.mp3
[6] http://securityreason.com/download/11/13
[7] http://net-security.org/vuln.php?id=14077

Changelog

[16.07.2009] - Initial release
[15.10.2010] - Added reference [7]

Contact

Zero Science Lab

Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk