|
|
 |
|
|
Pages: 1
Winamp Flaw Allows Attacks
(Click here to view the original thread with full colors/images)
Posted by: Ion Silverbolt
Yahoo News has some info about a security flaw in Winamp. They list it as critical.
The flaw, which Secunia rates as "highly critical," has been reported in Winamp versions 5.05 and 5.06. Prior versions also may be affected.
Security-Assessment.com, which is credited with finding the vulnerability, said a malicious hacker could cause a buffer overflow in various ways, the most dangerous being through a malformed .m3u playlist file.
"When hosted on a Web site, these files will be automatically downloaded and opened in Winamp without any user interaction. This is enough to cause the overflow that would allow a malicious playlist to overwrite EIP and execute arbitrary code," the company said.
The vulnerability exists due to a boundary error in the "IN_CDDA.dll" file," the company said.
Secunia recommends that users disassociate ".cda" and ".m3u" extensions from Winamp until the vendor releases a fix.
|
|
|
|
|
