Winamp Update Component Lack of Digital Signatures Lets Remote Users Install Arbitrary Code in Certain Cases
SecurityTracker Alert ID: 1020582|
SecurityTracker URL: http://securitytracker.com/id/1020582
(Links to External Site)
Updated: Aug 7 2008|
Original Entry Date: Jul 31 2008
Modification of system information|
Exploit Included: Yes |
A vulnerability was reported in Winamp. A remote user with the ability to masquerade as the update server can install arbitrary code on the target user's system.|
The update software does not digitally sign and verify software updates. A remote user with the ability to masquerade as the update server can cause arbitrary code to be installed on the target user's system when the target user's Winamp update utility performs an update.
A remote user can conduct DNS spoofing attacks, man-in-the-middle attacks, or other methods to potentially masquerade as the update server.
A demonstration exploit is available at:
Francisco Amato of Infobyte Security Research reported this vulnerability.
A remote user with the ability to spoof the DNS or conduct a man-in-the-middle attack can install arbitrary code on the target user's system.|
No solution was available at the time of this entry.|
Vendor URL: www.winamp.com/ (Links to External Site)
Source Message Contents
Date: Mon, 28 Jul 2008 07:19:54 -0300|
Subject: [Full-disclosure] Tool release: [evilgrade] - Using DNS cache
-- ISR - Infobyte Security Research
-- | ISR-evilgrade | www.infobyte.com.ar |
ISR-evilgrade: is a modular framework that allow us to take advantage of poor upgrade implementations by injecting fake updates.
* How does it work?
It works with modules, each module implements the structure needed to emulate a false update of specific applications/systems.
Evilgrade needs the manipulation of the victim dns traffic.
Internal scenary: (Internal DNS access,ARP spoofing,DNS Cache Poisoning, DHCP spoofing)
External scenary: (Internal DNS access,DNS Cache Poisoning)
* What are the supported OS?
The framework is multiplaform, it only depends of having the right payload for the target platform to be exploited.
- Java plugin
- Linkedin Toolbar
- DAP [Download Accelerator]
Demo feature - (Java plugin + Dan Kaminsky´s Dns vulnerability) = remote pwned.
..:: MORE INFORMATION
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/