Winamp Audio Player Buffer Overflows Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1005834 |
|
SecurityTracker URL: http://securitytracker.com/id/1005834
|
|
CVE Reference:
CAN-2002-1176, CAN-2002-1177
(Links to External Site)
|
Updated: Dec 1 2003
|
Original Entry Date: Dec 19 2002
|
Impact:
Denial of service via network, Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): versions 2.81, and version 3.0 prior to build #488
|
Description:
Several buffer overflow vulnerabilities were reported in Nullsoft's Winamp audio player. A remote user could create malicious MP3 files that will cause arbitrary code to be executed on the player.
Foundstone Research Labs issued an advisory warning that a remote user can create a specially crafted MP3 file containing a long Artist ID3v2 tag that, when loaded by Winamp 2.81, will trigger a buffer overflow and cause the player to crash.
A remote user can also create an MP3 file containing specially crafted Artist or Album fields of the ID3v2 tag that, when loaded via the Winamp 3.0 Media Library window, will trigger a buffer overflow and execute arbitrary code.
|
Impact:
A remote user can create a malicious MP3 file that will cause the player to crash or to execute arbitrary code. The code would run with the privileges of the Winamp user.
|
Solution:
The vendor has reportedly released fixed versions, available at:
http://www.winamp.com
Version 3.0 was corrected in Build #488 and later builds.
|
Vendor URL: www.winamp.com/ (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS:
Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Thu, 19 Dec 2002 17:41:46 -0500
Subject: ultiple Exploitable Buffer Overflows in Winamp
|
http://www.foundstone.com/knowledge/randd-advisories-display.html?id=338
Foundstone Research Labs issued an advisory (FS2002-10) warning of several buffer
overflows in the Winamp media player (versions 2.81, and version 3.0 prior to build #488).
A remote user can create a specially crafted MP3 file containing a long Artist ID3v2 tag
that, when loaded by Winamp 2.81, will trigger a buffer overflow and cause the player to
crash.
A remote user can create an MP3 file containing specially crafted Artist or Album fields
of the ID3v2 tag that, when loaded via the Winamp 3.0 Media Library window, will trigger a
buffer overflow and execute arbitrary code.
The vendor has reportedly released fixed versions, available at:
http://www.winamp.com
CVE: CAN-2002-1176, CAN-2002-1177
|
|
