Xenorate Media Player Stack-Based Buffer Overflow Vulnerability in .xpl Playlist Files

A stack-based buffer overflow vulnerability has been identified in Xenorate Media Player versions through 2.50. This Windows-based multimedia player fails to properly validate the length of input data when processing .xpl playlist files. As a result, an attacker can craft a malicious .xpl file that overwrites the Structured Exception Handler (SEH), potentially leading to arbitrary code execution. Exploitation of this vulnerability requires local interaction, typically by convincing a user to open the crafted file.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system.

Reproduction

The vulnerability can be reproduced by creating a specially crafted .xpl file that exploits the buffer overflow. This can be done using a Metasploit module available in the Metasploit Framework. The crafted file should be opened with Xenorate Media Player 2.50 to trigger the vulnerability.

Remediation

Users are advised to update to Xenorate version 2.6.1, which addresses this vulnerability. The update can be downloaded from the Xenorate website or applied using the Xenorate LiveUpdate feature.