NullSoft Winamp MIDI Plugin IN_MIDI.DLL Track Data Size Buffer Overflow Vulnerability

Bugtraq ID:	8567
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 08 2003 12:00AM
Updated:	Sep 08 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to Luigi Auriemma <[email protected]>.
Vulnerable:	NullSoft Winamp 3.1 NullSoft Winamp 3.0 NullSoft Winamp 2.91 NullSoft Winamp 2.81
Not Vulnerable:

NullSoft Winamp MIDI Plugin IN_MIDI.DLL Track Data Size Buffer Overflow Vulnerability

Winamp MIDI plugin, IN_MIDI.DLL has been reported prone to a buffer overflow issue when handling malicious MIDI files. The issue presents itself when a malicious value is passed as the Track Data Size of a malicious MIDI file header. Although unconfirmed it has been conjectured that an attacker may exploit this condition to execute arbitrary code in the context of the user who is running the affected Winamp player.

NullSoft Winamp MIDI Plugin IN_MIDI.DLL Track Data Size Buffer Overflow Vulnerability

The following proof of concept has been supplied:

4 bytes MIDI Header "MThd"
4 bytes Header data size 00000006
2 bytes Format 0000
2 bytes Number of tracks 0001
2 bytes Divisions 0001
4 bytes Track Header "MTrk"
4 bytes Track data size ffffffff <--- bug
... "aaaaaaaaaaaaaaaaaaaaa..." <--- fun

NullSoft Winamp MIDI Plugin IN_MIDI.DLL Track Data Size Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

NullSoft Winamp MIDI Plugin IN_MIDI.DLL Track Data Size Buffer Overflow Vulnerability

References:

• Winamp Home Page (NullSoft)
  
• RE: Winamp 2.91 lets code execution through MIDI files ("Thor Larholm" )
  
• Winamp 2.91 lets code execution through MIDI files (Luigi Auriemma )