Attack Chain

1. Attacker crafts a malicious input string containing shellcode.
2. The malicious string is designed to overwrite the Structured Exception Handler (SEH).
3. Attacker opens Allok Soft WMV to AVI MPEG DVD WMV Converter 4.6.1217.
4. Attacker inputs the crafted string into the “License Name” field within the application’s interface.
5. The application attempts to process the oversized input, triggering a buffer overflow.
6. The overflow overwrites the SEH with a pointer to the attacker-controlled shellcode.
7. An exception is triggered within the application.
8. The SEH handler is invoked, redirecting execution flow to the injected shellcode, enabling arbitrary code execution.

Impact

Successful exploitation of CVE-2018-25314 allows a local attacker to execute arbitrary code with the privileges of the Allok Soft WMV to AVI MPEG DVD WMV Converter application. This could lead to sensitive data theft, installation of malware, or complete system compromise. While specific victim counts are unavailable, any system running the vulnerable software is at risk.

Recommendation

• Monitor process creations for wmvconverter.exe spawning unusual child processes using the Alloksoft WMV Converter Spawning Suspicious Process Sigma rule.
• Monitor for unexpected registry modifications performed by wmvconverter.exe using the Alloksoft WMV Converter Registry Modification Sigma rule.
• Consider removing Allok Soft WMV to AVI MPEG DVD WMV Converter 4.6.1217 from systems where it is not essential, as no patch is available.