MS10-026 Microsoft MPEG Layer-3 Audio Stack Based Overflow

This module exploits a buffer overlow in l3codecx.ax while processing a AVI files with MPEG Layer-3 audio contents. The overflow only allows to overwrite with 0's so the three least significant bytes of EIP saved on stack are overwritten and shellcode is mapped using the .NET DLL memory technique pioneered by Alexander Sotirov and Mark Dowd. Please note on IE 8 targets, your malicious URL must be a trusted site in order to load the .Net control.

Search Other Modules

Exploit Rank

• Normal

Exploit Authors

• Yamata Li < >
• Shahin Ramezany < shahin [at] abysssec.com >
• juan vazquez < >
• Jordi Sanchez < jsanchez [at] 0x01000000.org >

Vulnerability References

• CVE-2010-0480
• OSVDB-63749
• BID-39303
• MSB-MS10-026
• http://www.exploit-db.com/moaub-5-microsoft-mpeg-layer-3-audio-stack-based-ov...
• http://www.phreedom.org/research/bypassing-browser-memory-protections/

Exploit Targets

• 0 - Windows XP SP3 Automatic (default)

Exploit Development

• Source Code
• History

Similar Exploit Modules

• exploit/windows/browser/adobe_cooltype_sing
• exploit/windows/browser/adobe_flash_mp4_cprt
• exploit/windows/browser/adobe_flash_sps
• exploit/windows/browser/adobe_flashplayer_avm
• exploit/windows/browser/adobe_flashplayer_flash10o
• exploit/windows/browser/adobe_flashplayer_newfunction
• exploit/windows/browser/adobe_flatedecode_predictor02
• exploit/windows/browser/adobe_geticon
• exploit/windows/browser/adobe_jbig2decode
• exploit/windows/browser/adobe_media_newplayer

Exploit Usage Information

Exploit Module Options