Executive brief
MJM QuickPlayer is a media player used to play various video and audio formats. A vulnerability in how the player handles music files allows an attacker to execute malicious code on a user's computer if the user is tricked into opening a specially crafted .s3m file. This could lead to a full system compromise, allowing an attacker to steal data or install malware.
Technical details
A stack-based buffer overflow exists in MJM QuickPlayer (versions 2010, 2.3, and 1.00 Beta 60a) within the file parser for .s3m music files. The vulnerability is caused by improper bounds checking when processing the file format, allowing an attacker to overwrite the stack and exception handler records. Exploitation requires a user to open a malicious .s3m file. Publicly available exploit code demonstrates that this flaw can be used to bypass DEP and ASLR protections using Return-Oriented Programming (ROP) techniques to achieve arbitrary code execution. As of the advisory date, the issue is reported as not fixed in the affected versions.
Affected products
- MJM Soft QuickPlayer 2010, 1.00 Beta 60a, 2.3
Timeline
- 2011-04-13: other: Vulnerability discovered
- 2011-04-20: other: Vendor contacted
- 2011-04-30: disclosed: Public disclosure and Metasploit module release
- 2025-08-20: advisory: CVE-2011-10023 published
References
- https://mjm-software.com/
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/mjm_quickplayer_s3m.rb
- https://web.archive.org/web/20111016194042/https://www.corelan.be/index.php/forum/security-advisories/corelan-11-003-mjm-quickplayer-2-3-2010-stack-buffer-overflow-s3m/
- https://www.exploit-db.com/exploits/17229
- https://www.vulncheck.com/advisories/mjm-quickplayer-s3m-stack-based-buffer-overflow