Author : KaDaL-X
email : [email protected]
website : http://kandangjamur.net
Software tested
Version : 0.99.4
Vendor : http://xine.sourceforge.net
Proof Of Concept :
Type in your unix console something like this :
kandangjamur$xine %p-%p.mp3
Then, there are two error alert box causing by this command :
Vulnerable code :
In src/xitk/main.c
/* (file name or mrl) */
case XINE_MSG_FILE_NOT_FOUND:
snprintf(buffer, sizeof(buffer), "%s", _("The specified file or mrl is not found. Please check it twic
e."));
if(data->explanation)
sprintf(buffer, "%s (%s)", buffer, (char *) data + data->parameters);
break;
The vulnerable variable is (char *) data + data->parameters, but i don't analyze this code to make clear
this problem (sorry). By giving comment in sprintf() function can be used to fix this issue,
but many format string issue may be happen on file main.c causing by (char *) data + data->parameters