AOH :: HP Unsorted N :: BU-1380.HTM

Nemesis Player (NSP) Local Denial of Service (DoS) Vulnerability



REWTERZ-20100102 - Nemesis Player (NSP) Local Denial of Service (DoS) Vulnerability
REWTERZ-20100102 - Nemesis Player (NSP) Local Denial of Service (DoS) Vulnerability



=======================================================Rewterz 05/01/2010

- Nemesis Player (NSP) Local Denial of Service (DoS) Vulnerability -

1) Affected Software

* NSP 2.0
* NSP 1.1 Beta


=======================================================2) Severity

Rating: High
Impact: Denial of Service
Where: Local


=======================================================3) Vendor's Description of Software

"The Nemesis Player (NSP) is much more than any other media player.
It allows you to watch your video files collection like any player
but also enables you to emulate a "DVD menu" for your videos.

Nsp can be broken down into 3 parts: Scene Editing, Project Settings
and the player itself."

Product Link:
http://www.nsplayer.org 


=======================================================4) Description of Vulnerability

Rewterz has discovered vulnerability in Nemesis Player (NSP). This
vulnerability could lead to Denial of Service with the privileges of
the current process or user and cause system to stop responding.

This vulnerability exists in the handling of Nsp project file. We chose
not to provide detailed information about the location of the
vulnerability and how to reproduce it because the author hasn't
confirmed this vulnerability. We can pass a long argument into the Nsp
project file. There is no checking of the length of these inputs.
Depending on the input, this will cause DoS condition.

We have confirmed the ability to execute our own code.


=======================================================5) Credits

Discovered by Rehan Ahmed, Rewterz.


=======================================================6) About Rewterz

Rewterz is a boutique Information Security company, committed to
consistently providing world class professional security services.
Our strategy revolves around the need to provide round-the-clock
quality information security services and solutions to our customers.
We maintain this standard through our highly skilled and professional
team, and custom-designed, customer-centric services and products.

http://www.rewterz.com 


Complete list of vulnerability advisories published by Rewterz:

http://rewterz.com/securityadvisories.php 


=======================================================

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.