Winamp LibSNDFile.DLL Component Remote Code Execution Vulnerability

Bugtraq ID:	23351
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 06 2007 12:00AM
Updated:	Apr 09 2007 09:12PM
Credit:	Piotr Bania is credited with the discovery of this issue.
Vulnerable:	NullSoft Winamp 5.33
Not Vulnerable:

Winamp LibSNDFile.DLL Component Remote Code Execution Vulnerability

Winamp is prone to a remote code-execution vulnerability resulting from an off-by-zero memory-corruption error.

An attacker can exploit this issue to execute arbitrary code with the privileges of the user running the application.

Winamp 5.33 is vulnerable; other versions may also be affected.

Winamp LibSNDFile.DLL Component Remote Code Execution Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to use the affected application to open a specially crafted file.

Winamp LibSNDFile.DLL Component Remote Code Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

Winamp LibSNDFile.DLL Component Remote Code Execution Vulnerability

References:

• Winamp Home Page (NullSoft)
  
• AOL Nullsoft Winamp LIBSNDFILE.DLL Remote Memory Corruption (Off By Zero) (Piotr Bania)