CVE-2009-1330

Description

Stack-based buffer overflow in Easy RM to MP3 Converter allows remote attackers to execute arbitrary code via a long filename in a playlist (.pls) file.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 10

Easy RM to MP3 Converter 2.7.3.700 - '.m3u' File (Universal ASLR + DEP Bypass) EDB-39933 · local · Jun 13, 2016 · verified
Easy RM to MP3 2.7.3.700 - '.m3u' / '.pls' / '.smi' / '.wpl' / '.wax' / '.wvx' / '.ram' Local Overflow EDB-14550 · local · Aug 4, 2010 · verified
Easy RM to MP3 27.3.700 (Windows XP SP2) - Local Buffer Overflow EDB-10619 · local · Dec 23, 2009 · verified
Easy RM to MP3 27.3.700 (Windows XP SP3) - Local Overflow EDB-10602 · local · Dec 22, 2009 · verified
Easy RM to MP3 Converter - Universal Stack Overflow EDB-8427 · local · Apr 14, 2009 · verified
Mini-stream Ripper - '.m3u' Local Stack Overflow (PoC) EDB-8402 · dos · Apr 13, 2009 · verified
WM Downloader - '.m3u' Local Stack Overflow (PoC) EDB-8403 · dos · Apr 13, 2009 · verified
RM Downloader - '.m3u' Local Stack Overflow (PoC) EDB-8404 · dos · Apr 13, 2009 · verified
Mini-stream RM-MP3 Converter 3.0.0.7 - '.m3u' Local Stack Overflow (PoC) EDB-8405 · dos · Apr 13, 2009 · verified
ASX to MP3 Converter - '.m3u' Local Stack Overflow (PoC) EDB-8407 · dos · Apr 13, 2009 · verified

GitHub 3 repositories

exploitwritter/CVE-2009-1330_EasyRMToMp3Converter ★ 0 · Feb 18, 2019

Easy RM to MP3 Converter es un software que sufre de una vulnerabiliad de desbordamiento de buffer basada en la pila o StackBufferOverflow lo cual puede permite a los atacantes remotos ejecutar códig…
war4uthor/CVE-2009-1330 ★ 0 · Jan 5, 2019

CVE-2009-1330 - Easy RM to MP3 Converter Local Buffer Overflow. Tested on Windows XP Professional SP3
adenkiewicz/CVE-2009-1330 ★ 0 · Dec 30, 2018

Simple exploit for Easy RM to MP3 Converter 2.7.3.700 on Windows 7 32b.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References

34514 vdb-entry
easyrmmp3-pls-bo(50326) vdb-entry
39933 exploit
8427 exploit