Winamp JPEG and PNG Multiple Integer Overflow Vulnerabilities

Bugtraq ID:	37387
Class:	Boundary Condition Error
CVE:	CVE-2009-4356
Remote:	Yes
Local:	No
Published:	Dec 17 2009 12:00AM
Updated:	Apr 13 2015 09:05PM
Credit:	Nicolas JOLY of VUPEN Security
Vulnerable:	NullSoft Winamp 5.3.2 NullSoft Winamp 5.0 91 NullSoft Winamp 5.0 9 NullSoft Winamp 5.0 8c NullSoft Winamp 5.0 8 NullSoft Winamp 5.0 7 NullSoft Winamp 5.0 6 NullSoft Winamp 5.0 5 NullSoft Winamp 5.0 4 NullSoft Winamp 5.0 3a NullSoft Winamp 5.0 3 NullSoft Winamp 5.0 2 NullSoft Winamp 5.0 1 NullSoft Winamp 5.56 NullSoft Winamp 5.552 NullSoft Winamp 5.55 NullSoft Winamp 5.541 NullSoft Winamp 5.54 NullSoft Winamp 5.52 NullSoft Winamp 5.51 NullSoft Winamp 5.5 NullSoft Winamp 5.35 NullSoft Winamp 5.34a NullSoft Winamp 5.34 NullSoft Winamp 5.33 NullSoft Winamp 5.31 NullSoft Winamp 5.3 NullSoft Winamp 5.24 NullSoft Winamp 5.22 NullSoft Winamp 5.21 NullSoft Winamp 5.2 NullSoft Winamp 5.13 NullSoft Winamp 5.12 NullSoft Winamp 5.11 NullSoft Winamp 5.094
Not Vulnerable:	NullSoft Winamp 5.57

Winamp JPEG and PNG Multiple Integer Overflow Vulnerabilities

Winamp is prone to multiple integer-overflow vulnerabilities because the application fails to perform adequate boundary checks on user-supplied input.

Attackers may leverage these issues to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

These issues affect versions *prior to* Winamp 5.57.

Winamp JPEG and PNG Multiple Integer Overflow Vulnerabilities

A commercial proof of concept is available through VUPEN Security - Exploit and PoCs Service. This proof of concept is not otherwise publicly available or known to be circulating in the wild.

Winamp JPEG and PNG Multiple Integer Overflow Vulnerabilities

Solution:
Vendor updates are available. Please see the references for details.

Winamp JPEG and PNG Multiple Integer Overflow Vulnerabilities

References:

• Winamp Homepage (Nullsoft)
  
• VUPEN Security Research - Winamp PNG and JPEG Data Integer Overflow Vulnerabilit ("VUPEN Security Research" )
  
• Winamp PNG and JPEG Data Handling Integer Overflow Vulnerabilities (VUPEN)