Info

Disclosure

Jan 30, 2006

Discovery

Unknown

Dates

Exploit

Jan 30, 2006

Solution

Unknown

Description

A remote overflow exists in WinAmp. WinAmp fails to perform correct boundary checks on playlists resulting in a buffer overflow. With a specially crafted playlist, an attacker can execute arbitrary code resulting in a loss of integrity.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Upgrade
Exploit: Exploit Public, Exploit Commercial
Disclosure: OSVDB Verified, Vendor Verified
OSVDB: Web Related

Solution

Upgrade to version 5.13 or higher, as it has been reported to fix this vulnerability. It is also possible to mitigate the flaw by disable auto launching Winamp for playlist files as a workaround.

Products

NullSoft

WinAmp

5.12

References

Security Tracker: 1015552
Milw0rm: 1458
Exploit Database: 1458
Bugtraq ID: 16410
Secunia Advisory ID: 18649
CVE ID: 2006-0476 (see also: NVD)
SCIP VulDB ID: 2018
Metasploit ID: 22789
ISS X-Force ID: 24361
CERT VU: 604745
VUPEN Advisory: ADV-2006-0361
Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-01/0477.html
http://archives.neohapsis.com/archives/bugtraq/2006-01/0499.html
http://archives.neohapsis.com/archives/fulldisclosure/2006-01/1001.html
Generic Exploit URL: http://immunitysec.com
http://www.saintcorporation.com/cgi-bin/exploit_info/winamp_playlist_file
http://www.spyinstructors.com/show.php?name=Advisories&pa=showpage&pid=71
Other Advisory URL: http://www.heise.de/newsticker/meldung/68981
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=377
Vendor URL: http://www.winamp.com/
Vendor Specific News/Changelog Entry: http://www.winamp.com/player/version_history.php

Credit

ATmaCA - atmacaicqmail.com - AtmacaSoft Inc.

Direct URL: http://osvdb.org/22789