Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
Winamp Buffer Overflow in Loading 'b4s' Playlists Lets Remote Users Execute Arbitrary Code on the Player
|
|
SecurityTracker Alert ID: 1005884 |
|
SecurityTracker URL: http://securitytracker.com/id/1005884
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Jan 4 2003
|
Impact:
Denial of service via network, Execution of arbitrary code via network, User access via network
|
|
Version(s): 3.0 build 488
|
Description:
A buffer overflow vulnerability was reported in the Winamp audio player. A remote user could execute arbitrary code on the target user's player.
Damage Hacking Group reported that a remote user can create a malicious 'b4s' playlist file. If the playlist 'label' field is longer than 16,580 bytes, a buffer overflow will be triggered when the player loads the malicious list. Arbitrary code can be executed, according to the report.
If the playlist 'label' field contains certain characters (such as Cyrillic characters), the player will reportedly crash when loading the malicious b4s playlist file.
A similar buffer overflow is reported in the 'Playstring' field. In addition, if the Playstring field is set to a DOS device name (e.g., "file:aux"), the player will crash when loading the playlist.
|
Impact:
A remote user can create a malicious playlist file that, when loaded by the target user, will cause arbitrary code to be executed on the target user's Winamp player with the privileges of the target user.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: www.winamp.com/ (Links to External Site)
|
Cause:
Boundary error, Exception handling error
|
Underlying OS:
Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Sat, 4 Jan 2003 05:00:47 -0800
Subject: [VulnWatch] WinAmp v.3.0: buffer overflow
|
#####################################################*
# Damage Hacking Group security advisory
# www.dhgroup.org
#####################################################*
#Product: WinAmp v.3.0 final (not beta :)) bld #488
#Authors: NullSoft, Inc. [www.winamp.com]
#Vulnerable versions: up to v.3.0
#Not vulnerable: all that doesn't support b4s-lists
#Vulnerability: buffer overflow (& code execution)
#####################################################*
#Overview#--------------------------------------------------------------#
IMHO, this is the most popular media player under win32-platforms.
#Problem#---------------------------------------------------------------#
First, what is b4s?
WinAmp allows u to save your mp3-list to *.b4s-files. This is something
like *.m3u-lists, but b4s uses XML for it's work. Here is example of one
b4s-file (# - comments):
<?xml version="1.0" encoding='UTF-8' standalone="yes"?>
<WinampXML>
<!-- Generated by: Nullsoft Winamp3 version 3.0 -->
<playlist num_entries="[number_of_entries]" label="[playlist_name]"> #(1)
#first entry
<entry Playstring="file:[patch_to_file]"> #(2)
<Name>[name_of_the_song]</Name>
<Length>[file_size_in_byts]</Lengt>
</entry>
#end of first entry
</playlist>
</WinampXML>
Now, lets talk about bugs.
(1) if [playlist_name] will be longer then 16580b, ecx, esi and retaddr(!!)
will be overwriten at addr 0x1007C340. So it's possible to execute
arbitrary code with user's permisson.
(2) buffer overflow in [patch_to_file]. I don't parse this problem,
but I realy think, that it's very serious too.
(3) DoS. If [playlist_name] will include some cyrilic (imho, any none
English) letters, WinAmp will be crashed.
(4) DOS Device bug. If [patch_to_file] will be "file:aux", WinAmp will
be freezed.
#Fix#--------------------------------------------------------------------#
Use m3u-lists :) & wait for new versions of WinAmp.
#Exploit#----------------------------------------------------------------#
Sorry, xsploit is private.
#EOF
Best regards www.dhgroup.org
D4rkGr3y icq 540981
|
|
Go to the Top of This SecurityTracker Archive Page
|
