← Advisories

Nero ShowTime 5.0.15.0 m3u Playlist File Remote Buffer Overflow PoC

High
Advisory ID
ZSL-2008-4902
Release Date
24 November 2008
Vendor
Nero AG / Nero Inc. / Nero K.K. / Nero Ltd - http://www.nero.com
Affected Version
5.0.15.0
Tested On
Microsoft Windows XP Professional SP2 (English)
Summary

Nero ShowTime provides you with a high-performance software DVD player that takes you to a new dimension in DVD's. Its cinema-like sound and excellent image quality for all digital pictures make an adventure of every film! What is more, Nero ShowTime supports all DVD-Video formats and can play them from a disc and from the hard drive.

Description

Nero ShowTime is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input. Successfully exploiting these issues may allow remote attackers to execute arbitrary code in the context of the application. Failed exploit attempts will cause denial-of-service conditions.

Proof of Concept
Disclosure Timeline
N/A
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
24.11.2008Initial release