Winamp Playlist Vulnerability
BID:925
Info
Winamp Playlist Vulnerability
| Bugtraq ID: | 925 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2000-0049 |
| Remote: | No |
| Local: | Yes |
| Published: | Jan 10 2000 12:00AM |
| Updated: | Jul 11 2009 01:56AM |
| Credit: | Posted to Bugtraq on January 10, 1999 by "Transfer Interrupted" <[email protected]>. |
| Vulnerable: |
NullSoft Winamp 2.10 |
| Not Vulnerable: |
NullSoft Winamp 2.5 E |
Discussion
Winamp Playlist Vulnerability
Winamp, a program for playing mp3 and other audio files, uses playlist files (*.pls) to store lists of files for playback. The code that reads these files has an unchecked buffer which can be overflowed to cause arbitrary code to be executed. If an entry longer than 580 bytes is specified in the file, EIP gets overwritten.
This vulnerability can only be exploited remotely by convincing someone to download the hostile playlist and load it into Winamp. IE5 will download .pls files without user confirmation if winamp is installed.
Winamp, a program for playing mp3 and other audio files, uses playlist files (*.pls) to store lists of files for playback. The code that reads these files has an unchecked buffer which can be overflowed to cause arbitrary code to be executed. If an entry longer than 580 bytes is specified in the file, EIP gets overwritten.
This vulnerability can only be exploited remotely by convincing someone to download the hostile playlist and load it into Winamp. IE5 will download .pls files without user confirmation if winamp is installed.
Exploit / POC
Solution / Fix
Winamp Playlist Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].