Fuzzing-based Vulnerability Analysis for Multimedia Players
Dong-Jin Kim, Seong-je Cho · 2011
As multimedia is widely used in the Internet, lots of vulnerabilities have been found in multimedia players and files. In this paper, we propose a novel process to analyze and detect security vulnerabilities of multimedia players by manipulating input data, which is based on fuzzing. The proposed process has analyzed and classified the vulnerabilities incurred by inputting the four types of fuzzed data into the target player, where the fuzzed data have been obtained by performing simple random-based, simple mutation-based, structured random-based, and structured mutation-based fuzzing for the binary or plain text input files of the player. To verify our process, we have experimented and checked it using proof-of-concept data with exploit code for the detected vulnerabilities on MS Windows XP Service Pack 3. Through the experiments, we have found other nineteen vulnerabilities in 26 other players from the help of known vulnerabilities of certain media players and new five vulnerable modules in 4 media players using the structured mutation-based fuzzing.