CVE-2009-0261

published 2009-01-23

CVE-2009-0261: Stack-based buffer overflow in EffectMatrix Total Video Player 1.31 allows user-assisted attackers to execute arbitrary code via a…

Priority P3 43 critical 9.3 CVSS 2.0

AV N AC M Au N C C I C A C

EXPLOIT

Stack-based buffer overflow in EffectMatrix Total Video Player 1.31 allows user-assisted attackers to execute arbitrary code via a Skins\DefaultSkin\DefaultSkin.ini file with a large ColumnHeaderSpan value.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
effectmatrix	total_video_player	—	—

Detection & IOCs extracted from sources · hover to see the quote

filename DefaultSkin.ini↗

path Skins\DefaultSkin\DefaultSkin.ini↗

path C:\Program Files\Total Video Player\↗

filename Settings.ini↗

bytes↗

\x29\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xd5\xc5\x35\xef\x83\xeb\xfc\xe2\xf4\x29\x2d\x71\xef\xd5\xc5\xbe\xaa\xe9\x4e\x49\xea\xad\xc4\xda\x64\x9a\xdd\xbe\xb0\xf5\xc4\xde\xa6\x5e\xf1\xbe\xee\x3b\xf4\xf5\x76\x79\x41\xf5\x9b\xd2\x04\xff\xe2\xd4\x07\xde\x1b\xee\x91\x11\xeb\xa0\x20\xbe\xb0\xf1\xc4\xde\x89\x5e\xc9\x7e\x64\x8a\xd9\x34\x04\x5e\xd9\xbe\xee\x3e\x4c\x69\xcb\xd1\x06\x04\x2f\xb1\x4e\x75\xdf\x50\x05\x4d\xe3\x5e\x85\x39\x64\xa5\xd9\x98\x64\xbd\xcd\xde\xe6\x5e\x45\x85\xef\xd5\xc5\xbe\x87\xe9\x9a\x04\x19\xb5\x93\xbc\x17\x56\x05\x4e\xbf\xbd\x35\xbf\xeb\x8a\xad\xad\x11\x5f\xcb\x62\x10\x32\xa6\x54\x83\xb6\xc5\x35\xef

bytes↗

\x7C\xE1\xA7\x7C

• → Trigger condition is a large `ColumnHeaderSpan` value in the INI file; look for abnormally long (>221 bytes) ColumnHeaderSpan field in DefaultSkin.ini or Settings.ini ↗
• → Exploit buffer structure: 221 bytes of 0x41 padding followed by SEH overwrite address 0x7CA7E17C; detect this byte pattern in INI files opened by Total Video Player ↗
• → Exploit is a SEH-based buffer overflow (EXITFUNC=seh); monitor for SEH chain corruption in Total Video Player process (TVPlayer.exe or similar) when parsing INI files ↗
• → NOP sled of 20 bytes (0x90) precedes shellcode; presence of NOP sled + shellcode blob in a .ini file is a strong indicator of exploitation attempt ↗

• · The exploit was tested on Windows XP Pro SP2, Windows XP SP3, Windows 7, and Windows 8; the hardcoded SEH overwrite address (0x7CA7E17C) is platform/module-specific and may not apply to all OS versions ↗
• · The vulnerability is user-assisted (local file format exploit); exploitation requires the victim to open a maliciously crafted DefaultSkin.ini or Settings.ini file with Total Video Player 1.31 ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119