Winamp CAF File Integer Overflow Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1021784 |
|
SecurityTracker URL: http://securitytracker.com/id/1021784
|
|
CVE Reference:
CVE-2009-0186
(Links to External Site)
|
Date: Mar 4 2009
|
Impact:
Execution of arbitrary code via network, User access via network
|
Vendor Confirmed: Yes
|
Version(s): 5.541, 5.55; possibly other versions
|
Description:
A vulnerability was reported in Winamp. A remote user can cause arbitrary code to be executed on the target user's system.
A remote user can create a specially crafted CAF file that, when loaded by the target user, will trigger an integer overflow in 'libsndfile.dll' and execute arbitrary code on the target system. The code will run with the privileges of the target user.
The vendor was notified on February 20, 2009.
Alin Rad Pop of Secunia Research reported this vulnerability.
[Editor's note: The vulnerability resides in the libsndfile code that is included within Winamp.]
|
Impact:
A remote user can create a file that, when loaded by the target user, will execute arbitrary code on the target user's system.
|
Solution:
No solution was available at the time of this entry.
[Editor's note: The libsndfile project has issued a fixed version (1.0.19) of libsndfile.]
|
Vendor URL: www.winamp.com/ (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS: Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Subject: Secunia Research: Winamp CAF Processing Integer Overflow Vulnerability
|
======================================================================
Secunia Research 03/03/2009
- Winamp CAF Processing Integer Overflow Vulnerability -
======================================================================
Table of Contents
Affected Software....................................................1
Severity.............................................................2
Vendor's Description of Software.....................................3
Description of Vulnerability.........................................4
Solution.............................................................5
Time Table...........................................................6
Credits..............................................................7
References...........................................................8
About Secunia........................................................9
Verification........................................................10
======================================================================
1) Affected Software
* Winamp 5.541 and 5.55
NOTE: Other versions may also be affected.
======================================================================
2) Severity
Rating: Highly critical
Impact: System access
Where: Remote
======================================================================
3) Vendor's Description of Software
"... Winamp, The #1 Free Media Player. Play your MP3, AAC, MPEG, AVI
files, and more. Get free MP3 songs, videos, skins and plug-ins.
Synch your iPod or Creative Zen, and get mobile music with Winamp
Remote."
Product Link:
http://www.winamp.com/
======================================================================
4) Description of Vulnerability
Secunia Research has discovered a vulnerability in Winamp, which can
be exploited by malicious people to compromise a user's system.
The vulnerability is caused due to an integer overflow error in the
libsndfile.dll library while processing CAF description chunks. This
can be exploited to cause a heap-based buffer overflow by tricking a
user into processing a specially crafted CAF audio file.
Successful exploitation may allow execution of arbitrary code.
======================================================================
5) Solution
Do not open untrusted CAF files in Winamp.
======================================================================
6) Time Table
20/02/2009 - Vendor notified.
21/02/2009 - Vendor response.
03/03/2009 - libsndfile upstream releases fixed version and details.
03/03/2009 - Public disclosure.
======================================================================
7) Credits
Discovered by Alin Rad Pop, Secunia Research.
======================================================================
8) References
The Common Vulnerabilities and Exposures (CVE) project has assigned
CVE-2009-0186 for the vulnerability.
======================================================================
9) About Secunia
Secunia offers vulnerability management solutions to corporate
customers with verified and reliable vulnerability intelligence
relevant to their specific system configuration:
http://secunia.com/advisories/business_solutions/
Secunia also provides a publicly accessible and comprehensive advisory
database as a service to the security community and private
individuals, who are interested in or concerned about IT-security.
http://secunia.com/advisories/
Secunia believes that it is important to support the community and to
do active vulnerability research in order to aid improving the
security and reliability of software in general:
http://secunia.com/secunia_research/
Secunia regularly hires new skilled team members. Check the URL below
to see currently vacant positions:
http://secunia.com/corporate/jobs/
Secunia offers a FREE mailing list called Secunia Security Advisories:
http://secunia.com/advisories/mailing_lists/
======================================================================
10) Verification
Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2009-8/
Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/
======================================================================
|
|
