Twenty Year Anniversary

NSFOCUS Security Advisory 2005.1

NSFOCUS Security Advisory 2005.1
Posted Jan 28, 2005
Authored by NSFOCUS, Yu Yang | Site nsfocus.com

NSFOCUS Security Advisory(SA2005-01) - NSFocus Security Team has found a buffer overflow vulnerability in the plug-in by which WinAMP plays CD. An attacker can construct a malicious playlist file that is embedded in a HTML page. If a user is persuaded to click it, then the attacker can gain complete control over the user's system. All versions below 5.08c are affected.

tags | advisory, overflow
advisories | CVE-2004-1150
MD5 | 22d47dab1a0c8238060b802240ead145

NSFOCUS Security Advisory 2005.1

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

NSFOCUS Security Advisory(SA2005-01)

Topic: Buffer Overflow in WinAMP in_cdda.dll CDA Device Name

Release Date: 2005-01-27

CVE CAN ID: CAN-2004-1150

http://www.nsfocus.com/english/homepage/research/0501.htm

Affected systems & software
===========================
Nullsoft WinAMP 5.0
Nullsoft WinAMP 5.01
Nullsoft WinAMP 5.02
Nullsoft WinAMP 5.03
Nullsoft WinAMP 5.04
Nullsoft WinAMP 5.05
Nullsoft WinAMP 5.06
Nullsoft WinAMP 5.07
Nullsoft WinAMP 5.08

Unaffected systems & software
=============================
Nullsoft WinAMP 2.X
Nullsoft WinAMP 5.08c

Summary
=========

WinAMP is a popular media player that supports various media and playlist
formats, including playlists in m3u or pls format.

NSFocus Security Team has found a buffer overflow vulnerability in the
plug-in by which WinAMP plays CD. An attacker can construct a malicious playlist
file that is embedded in a HTML page. If a user is persuaded to click it,
then the attacker can gain complete control over the user's system.

Description
============

WinAMP implements various functionalities through different plug-ins that
are stored in "plugins" sub-directory of WinAMP installation directory. For
example, in_mp3.dll is used to play MP3 files and in_cdda.dll is used to
play CD.

The in_cdda.dll of WinAMP supports play path requests in the following format:

1. <Driver\><PathName\>[FileName].cda
2. linein://
3. cda://
4. cda://<Driver>
5. cda://<Driver>,<TrackNumber>

Brett Moore of Security-Assessment.com discovered a stack overflow when in_cdda.dll
handles the first path. WinAMP released version 5.07 to fix that vulnerability.

Actually, in_cdda.dll will still cause an overflow when handling 4th and 5th
path above. Stack overflow will be triggered only by adding an over-long device
name or sound track number behind "cda://".

Any method that can pass a play path to WinAMP can be used to trigger this
vulnerability, for example, command line.

One possible remote attacking vector is to construct a playlist file in m3u
or pls format with an over-long path embedded in HTML. Once a user visits
such a malicious page, it will execute the code of attacker's choice.

Workaround
=============

NSFOCUS suggests to remove in_cdda.dll from Plugins of WinAMP.

Vendor Status
==============

2004.11.24 Informed the vendor support@winamp.com, no response
2004.12.06 Tests proved winamp 5.07 is affected, informed the vendor again
2004.12.07 The vendor confirmed the vulnerability
2004.12.25 Tests proved winamp 5.08 is affected, informed the vendor
2005.01.10 The vendor released winamp 5.08c to fix the vulnerability

The vendor has released winamp 5.08c to fix this vulnerability. The latest
version is available at http://www.winamp.com/player/

Additional Information
========================

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CAN-2004-1150 to this issue. This is a candidate for inclusion in the
CVE list (http://cve.mitre.org), which standardizes names for security problems.
Candidates may change significantly before they become official CVE entries.

Acknowledgment
===============

Yu Yang of NSFOCUS Security Team found the vulnerability.

DISCLAIMS
==========
THE INFORMATION PROVIDED IS RELEASED BY NSFOCUS "AS IS" WITHOUT WARRANTY
OF ANY KIND. NSFOCUS DISCLAIMS ALL WARRANTIES, EITHER EXPRESSED OR IMPLIED,
EXCEPT FOR THE WARRANTIES OF MERCHANTABILITY. IN NO EVENT SHALL NSFOCUS
BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT,
INCIDENTAL,CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES,
EVEN IF NSFOCUS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
DISTRIBUTION OR REPRODUCTION OF THE INFORMATION IS PROVIDED THAT THE
ADVISORY IS NOT MODIFIED IN ANY WAY.

Copyright 1999-2005 NSFOCUS. All Rights Reserved. Terms of use.


NSFOCUS Security Team <security@nsfocus.com>
NSFOCUS INFORMATION TECHNOLOGY CO.,LTD
(http://www.nsfocus.com)

PGP Key: http://www.nsfocus.com/homepage/research/pgpkey.asc
Key fingerprint = F8F2 F5D1 EF74 E08C 02FE 1B90 D7BF 7877 C6A6 F6DA

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQFB+LIY1794d8am9toRAt5+AJ9fhmdoxO3wi4px9hPTftLUDfRllgCfYequ
nhWVWcvuVIs8339yXR+TiPU=
=yjQM
-----END PGP SIGNATURE-----

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

August 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    19 Files
  • 2
    Aug 2nd
    17 Files
  • 3
    Aug 3rd
    16 Files
  • 4
    Aug 4th
    1 Files
  • 5
    Aug 5th
    1 Files
  • 6
    Aug 6th
    19 Files
  • 7
    Aug 7th
    15 Files
  • 8
    Aug 8th
    9 Files
  • 9
    Aug 9th
    7 Files
  • 10
    Aug 10th
    10 Files
  • 11
    Aug 11th
    1 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    14 Files
  • 14
    Aug 14th
    4 Files
  • 15
    Aug 15th
    23 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close