CVE-2011-10022
HIGHSPlayer < 3.7 (Build 2055) - Stack-Based Buffer Overflow via HTTP Content-Type Header
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2011-10022.
PoCs published by Metasploit, xsploitedsec, including Metasploit module exploits/windows/misc/splayer_content_type.
AI-analyzed exploit summary This Metasploit module exploits a buffer overflow vulnerability in SPlayer 3.7 by sending a malicious 'Content-Type' header with excessive length, leading to arbitrary remote code execution. The exploit uses a unicode payload and SEH overwrite technique to achieve reliable exploitation.
Description
SPlayer version 3.7 and earlier is vulnerable to a stack-based buffer overflow when processing HTTP responses containing an overly long Content-Type header. The vulnerability occurs due to improper bounds checking on the header value, allowing an attacker to overwrite the Structured Exception Handler (SEH) and execute arbitrary code. Exploitation requires the victim to open a media file that triggers an HTTP request to a malicious server, which responds with a crafted Content-Type header.
Exploits (3)
This Metasploit module exploits a buffer overflow vulnerability in SPlayer 3.7 by sending a malicious 'Content-Type' header with excessive length, leading to arbitrary remote code execution. The exploit uses a unicode payload and SEH overwrite technique to achieve reliable exploitation.
This exploit demonstrates a buffer overflow vulnerability in SPlayer <= 3.7 (build 2055) by sending a maliciously crafted HTTP response with an oversized 'Content-Type' header. The payload includes shellcode to spawn calc.exe and leverages a SEH overwrite to achieve remote code execution.
This Metasploit module exploits a buffer overflow in SPlayer 3.7 via an excessively long 'Content-Type' header, leading to arbitrary remote code execution. It uses a Unicode-aware payload and SEH overwrite technique to achieve exploitation.
References (5)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N