Nullsoft Winamp M3U File Denial of Service Vulnerability

Bugtraq ID:	16623
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 13 2006 12:00AM
Updated:	Feb 14 2006 09:13PM
Credit:	b0f is credited with the discovery of this vulnerability.
Vulnerable:	NullSoft Winamp 5.13
Not Vulnerable:

Nullsoft Winamp M3U File Denial of Service Vulnerability

Winamp is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to crash the application, effectively denying service to legitimate users. An attacker may be able to exploit this issue to execute arbitrary code on the victim user's computer; this has not been confirmed.

This issue is reported to affect version 5.13; other versions may also be vulnerable.

This issue may be related to BID 9923 (NullSoft Winamp Malformed File Name Denial of Service Vulnerability).

Nullsoft Winamp M3U File Denial of Service Vulnerability


An exploit is not required.

Nullsoft Winamp M3U File Denial of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

Nullsoft Winamp M3U File Denial of Service Vulnerability

References:

• Winamp Home Page (NullSoft)
  
• New winamp m3u/pls .WMA & .M3U Extension overflows ([email protected])