Millenium MP3 Studio <= 2.0 .pls File Stack-Based Buffer Overflow
Vulnerability Description
Millenium MP3 Studio versions up to and including 2.0 is vulnerable to a stack-based buffer overflow when parsing .pls playlist files. The application fails to properly validate the length of the File1 field within the playlist, allowing an attacker to craft a malicious .pls file that overwrites the Structured Exception Handler (SEH) and executes arbitrary code. Exploitation requires the victim to open the file locally, though remote execution may be possible if the .pls extension is registered to the application and opened via a browser.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2009-20002
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- hack4love
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/millenium_mp3_pls.rb
- https://www.exploit-db.com/exploits/9618
- https://www.exploit-db.com/exploits/10240
- https://web.archive.org/web/20090731112010/http://www.milw0rm.com/exploits/9277
- https://ccm.net/downloads/sound/5995-millennium-mp3-studio/
- https://www.vulncheck.com/advisories/millenium-mp3-studio-pls-file-stack-based-buffer-overflow
Affected Vendor
Millenium
View all reports →