SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Multimedia)  >   Winamp Vendors:   Nullsoft
Winamp CAF File Integer Overflow Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1021784
SecurityTracker URL:  http://securitytracker.com/id/1021784
CVE Reference:   CVE-2009-0186   (Links to External Site)
Date:  Mar 4 2009
Impact:   Execution of arbitrary code via network, User access via network
Vendor Confirmed:  Yes  
Version(s): 5.541, 5.55; possibly other versions
Description:   A vulnerability was reported in Winamp. A remote user can cause arbitrary code to be executed on the target user's system.

A remote user can create a specially crafted CAF file that, when loaded by the target user, will trigger an integer overflow in 'libsndfile.dll' and execute arbitrary code on the target system. The code will run with the privileges of the target user.

The vendor was notified on February 20, 2009.

Alin Rad Pop of Secunia Research reported this vulnerability.

[Editor's note: The vulnerability resides in the libsndfile code that is included within Winamp.]

Impact:   A remote user can create a file that, when loaded by the target user, will execute arbitrary code on the target user's system.
Solution:   No solution was available at the time of this entry.

[Editor's note: The libsndfile project has issued a fixed version (1.0.19) of libsndfile.]

Vendor URL:  www.winamp.com/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  Secunia Research: Winamp CAF Processing Integer Overflow Vulnerability

====================================================================== 

                     Secunia Research 03/03/2009

       - Winamp CAF Processing Integer Overflow Vulnerability -

====================================================================== 
Table of Contents

Affected Software....................................................1
Severity.............................................................2
Vendor's Description of Software.....................................3
Description of Vulnerability.........................................4
Solution.............................................................5
Time Table...........................................................6
Credits..............................................................7
References...........................................................8
About Secunia........................................................9
Verification........................................................10

====================================================================== 
1) Affected Software 

* Winamp 5.541 and 5.55

NOTE: Other versions may also be affected.

====================================================================== 
2) Severity 

Rating: Highly critical 
Impact: System access
Where:  Remote

====================================================================== 
3) Vendor's Description of Software 

"... Winamp, The #1 Free Media Player. Play your MP3, AAC, MPEG, AVI 
files, and more. Get free MP3 songs, videos, skins and plug-ins. 
Synch your iPod or Creative Zen, and get mobile music with Winamp 
Remote."

Product Link:
http://www.winamp.com/

====================================================================== 
4) Description of Vulnerability

Secunia Research has discovered a vulnerability in Winamp, which can 
be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an integer overflow error in the 
libsndfile.dll library while processing CAF description chunks. This 
can be exploited to cause a heap-based buffer overflow by tricking a
user into processing a specially crafted CAF audio file.

Successful exploitation may allow execution of arbitrary code.

====================================================================== 
5) Solution 

Do not open untrusted CAF files in Winamp.

====================================================================== 
6) Time Table 

20/02/2009 - Vendor notified.
21/02/2009 - Vendor response.
03/03/2009 - libsndfile upstream releases fixed version and details.
03/03/2009 - Public disclosure.

====================================================================== 
7) Credits 

Discovered by Alin Rad Pop, Secunia Research.

====================================================================== 
8) References

The Common Vulnerabilities and Exposures (CVE) project has assigned
CVE-2009-0186 for the vulnerability.

====================================================================== 
9) About Secunia

Secunia offers vulnerability management solutions to corporate
customers with verified and reliable vulnerability intelligence
relevant to their specific system configuration:

http://secunia.com/advisories/business_solutions/

Secunia also provides a publicly accessible and comprehensive advisory
database as a service to the security community and private 
individuals, who are interested in or concerned about IT-security.

http://secunia.com/advisories/

Secunia believes that it is important to support the community and to
do active vulnerability research in order to aid improving the 
security and reliability of software in general:

http://secunia.com/secunia_research/

Secunia regularly hires new skilled team members. Check the URL below
to see currently vacant positions:

http://secunia.com/corporate/jobs/

Secunia offers a FREE mailing list called Secunia Security Advisories:

http://secunia.com/advisories/mailing_lists/

====================================================================== 
10) Verification 

Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2009-8/

Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/

======================================================================

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC