CVE-2010-0480
EXPLOITEDMicrosoft Windows MPEG Layer-3 Audio Codecs - Remote Code Execution via Crafted AVI File
Title source: llmExploitation Summary
CVE-2010-0480 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 4 public exploits from researchers including Metasploit, Abysssec, Yamata Li, including a Metasploit module exploits/windows/browser/ms10_026_avi_nsamplespersec.
AI-analyzed exploit summary This Metasploit module exploits a stack-based buffer overflow in l3codecx.ax via a maliciously crafted AVI file with MPEG Layer-3 audio content. It leverages the .NET DLL memory technique to achieve remote code execution on vulnerable Windows systems.
Description
Multiple stack-based buffer overflows in the MPEG Layer-3 audio codecs in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allow remote attackers to execute arbitrary code via a crafted AVI file, aka "MPEG Layer-3 Audio Decoder Stack Overflow Vulnerability."
Exploits (4)
This Metasploit module exploits a stack-based buffer overflow in l3codecx.ax via a maliciously crafted AVI file with MPEG Layer-3 audio content. It leverages the .NET DLL memory technique to achieve remote code execution on vulnerable Windows systems.
This exploit generates a malformed AVI file by modifying the 'nSamplesPerSec' field to trigger a division-by-zero vulnerability in Microsoft MPEG Layer-3 Audio Decoder (l3codeca.acm). The PoC creates a proof-of-concept file ('poc.avi') that can cause a denial-of-service when processed by the vulnerable decoder.
This exploit targets a stack-based buffer overflow in Microsoft MPEG Layer-3 audio codec (l3codeca.acm) via a crafted HTML file embedding a malicious DLL. The shellcode executes arbitrary commands, demonstrating remote code execution (RCE).
This Metasploit module exploits a stack-based buffer overflow in l3codecx.ax via a maliciously crafted AVI file with MPEG Layer-3 audio content. It leverages the .NET DLL memory technique to achieve remote code execution by overwriting the least significant bytes of EIP with zeros.