CVE-2004-1150
CVSS5.1
发布时间 :2004-12-31 00:00:00
修订时间 :2016-10-17 22:51:47
NMCOPS    

[原文]Stack-based buffer overflow in the in_cdda.dll plugin for Winamp 5.0 through 5.08c allows attackers to execute arbitrary code via a cda:// URL with a long (1) device name or (2) sound track number, as demonstrated with a .m3u or .pls playlist file.


[CNNVD]WinAMP in_cdda.dll CDA设备名缓冲区溢出漏洞(CNNVD-200412-1155)

        
        WinAMP通过不同的插件来实现各种功能,这些插件保存在WinAMP安装目录的plugins子目录下。例如,in_mp3.dll是用来播放MP3文件的,in_cdda.dll是用来播放CD的。
        WinAMP的in_cdda.dll至少支持以下格式的播放路径请求:
        1、[FileName].cda
        2、linein://
        3、cda://
        4、cda://
        5、cda://
        Security-Assessment.com的Brett Moore发现了in_cdda.dll 在处理第一种路径的时候会发生堆栈溢出。WinAMP 发布了5.07版并修复了该漏洞。
        但事实上,in_cdda.dll在处理上面的第四和第五种路径时也会发生溢出。只要在"cda://"后面添加过长的设备名或音轨号,就会导致栈溢出。
        凡是可以向WinAMP传递播放路径的方式都可以用来触发该漏洞,例如通过命令行。
        一种可能的远程利用方式是构造包含超长路径的m3u或者pls格式的播放列表文件,嵌入在HTML中,只要用户访问了这样的恶意网页,就会执行攻击者的代码。
        

- CVSS (基础分值)

CVSS分值: 5.1 [中等(MEDIUM)]
机密性影响: [--]
完整性影响: [--]
可用性影响: [--]
攻击复杂度: [--]
攻击向量: [--]
身份认证: [--]

- CPE (受影响的平台与产品)

cpe:/a:nullsoft:winamp:5.07Nullsoft Winamp 5.07
cpe:/a:nullsoft:winamp:5.04Nullsoft Winamp 5.04
cpe:/a:nullsoft:winamp:5.03Nullsoft Winamp 5.03
cpe:/a:nullsoft:winamp:5.0Nullsoft Winamp 5.0
cpe:/a:nullsoft:winamp:5.06Nullsoft Winamp 5.06
cpe:/a:nullsoft:winamp:5.05Nullsoft Winamp 5.05
cpe:/a:nullsoft:winamp:5.02Nullsoft Winamp 5.02
cpe:/a:nullsoft:winamp:5.01Nullsoft Winamp 5.01
cpe:/a:nullsoft:winamp:5.08cNullsoft Winamp 5.08c

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1150
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2004-1150
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200412-1155
(官方数据源) CNNVD

- 其它链接及资源

http://marc.info/?l=bugtraq&m=110684140108614&w=2
(UNKNOWN)  BUGTRAQ  20050127 NSFOCUS SA2005-01 : Buffer Overflow in WinAMP in_cdda.dll CDA Device Name
http://www.nsfocus.com/english/homepage/research/0501.htm
(UNKNOWN)  MISC  http://www.nsfocus.com/english/homepage/research/0501.htm
http://www.securityfocus.com/bid/12381
(UNKNOWN)  BID  12381
http://www.winamp.com/player/version_history.php
(UNKNOWN)  CONFIRM  http://www.winamp.com/player/version_history.php
http://xforce.iss.net/xforce/xfdb/18840
(UNKNOWN)  XF  winamp-incdda-bo(18840)

- 漏洞信息

WinAMP in_cdda.dll CDA设备名缓冲区溢出漏洞
中危 边界条件错误
2004-12-31 00:00:00 2005-10-20 00:00:00
远程  
        
        WinAMP通过不同的插件来实现各种功能,这些插件保存在WinAMP安装目录的plugins子目录下。例如,in_mp3.dll是用来播放MP3文件的,in_cdda.dll是用来播放CD的。
        WinAMP的in_cdda.dll至少支持以下格式的播放路径请求:
        1、[FileName].cda
        2、linein://
        3、cda://
        4、cda://
        5、cda://
        Security-Assessment.com的Brett Moore发现了in_cdda.dll 在处理第一种路径的时候会发生堆栈溢出。WinAMP 发布了5.07版并修复了该漏洞。
        但事实上,in_cdda.dll在处理上面的第四和第五种路径时也会发生溢出。只要在"cda://"后面添加过长的设备名或音轨号,就会导致栈溢出。
        凡是可以向WinAMP传递播放路径的方式都可以用来触发该漏洞,例如通过命令行。
        一种可能的远程利用方式是构造包含超长路径的m3u或者pls格式的播放列表文件,嵌入在HTML中,只要用户访问了这样的恶意网页,就会执行攻击者的代码。
        

- 公告与补丁

        临时解决方法:
        如果您不能立刻安装补丁或者升级,CNNVD建议您采取以下措施以降低威胁:
        * 将in_cdda.dll从WinAMP的Plugins目录中移走。
        厂商补丁:
        NSFOCUS
        -------
        NSFOCUS已经为此发布了一个安全公告(SA2005-01):
        SA2005-01:Buffer Overflow in WinAMP in_cdda.dll CDA Device Name
        链接:
        http://www.nsfocus.net/index.php?act=advisory&do=view&adv_id=35

        补丁下载:
        
        http://www.winamp.com/player/

- 漏洞信息 (F35943)

exploits-winamp.tgz (PacketStormID:F35943)
2005-01-28 00:00:00
Rojodos  
exploit,overflow
CVE-2004-1150
[点击下载]

Two exploits for Winamp 5.05 and 5.08. They make use of the buffer overflow vulnerability discovered by NSFOCUS.

- 漏洞信息 (F35931)

NSFOCUS Security Advisory 2005.1 (PacketStormID:F35931)
2005-01-28 00:00:00
NSFOCUS,Yu Yang  nsfocus.com
advisory,overflow
CVE-2004-1150
[点击下载]

NSFOCUS Security Advisory(SA2005-01) - NSFocus Security Team has found a buffer overflow vulnerability in the plug-in by which WinAMP plays CD. An attacker can construct a malicious playlist file that is embedded in a HTML page. If a user is persuaded to click it, then the attacker can gain complete control over the user's system. All versions below 5.08c are affected.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

NSFOCUS Security Advisory(SA2005-01)

Topic: Buffer Overflow in WinAMP in_cdda.dll CDA Device Name

Release Date: 2005-01-27

CVE CAN ID: CAN-2004-1150

http://www.nsfocus.com/english/homepage/research/0501.htm

Affected systems & software
===========================
Nullsoft WinAMP 5.0
Nullsoft WinAMP 5.01
Nullsoft WinAMP 5.02
Nullsoft WinAMP 5.03
Nullsoft WinAMP 5.04
Nullsoft WinAMP 5.05
Nullsoft WinAMP 5.06
Nullsoft WinAMP 5.07
Nullsoft WinAMP 5.08

Unaffected systems & software
=============================
Nullsoft WinAMP 2.X
Nullsoft WinAMP 5.08c

Summary
=========

WinAMP is a popular media player that supports various media and playlist
formats, including playlists in m3u or pls format.
  
NSFocus Security Team has found a buffer overflow vulnerability in the 
plug-in by which WinAMP plays CD. An attacker can construct a malicious playlist
file that is embedded in a HTML page. If a user is persuaded to click it, 
then the attacker can gain complete control over the user's system.

Description
============

WinAMP implements various functionalities through different plug-ins that
are stored in "plugins" sub-directory of WinAMP installation directory. For
example, in_mp3.dll is used to play MP3 files and in_cdda.dll is used to 
play CD.
  
The in_cdda.dll of WinAMP supports play path requests in the following format:

  1. <Driver\><PathName\>[FileName].cda
  2. linein://
  3. cda://
  4. cda://<Driver>
  5. cda://<Driver>,<TrackNumber>
  
Brett Moore of Security-Assessment.com discovered a stack overflow when in_cdda.dll
handles the first path. WinAMP released version 5.07 to fix that vulnerability.

Actually, in_cdda.dll will still cause an overflow when handling 4th and 5th
path above. Stack overflow will be triggered only by adding an over-long device 
name or sound track number behind "cda://".

Any method that can pass a play path to WinAMP can be used to trigger this 
vulnerability, for example, command line.

One possible remote attacking vector is to construct a playlist file in m3u 
or pls format with an over-long path embedded in HTML. Once a user visits
such a malicious page, it will execute the code of attacker's choice.   

Workaround
=============

NSFOCUS suggests to remove in_cdda.dll from Plugins of WinAMP.

Vendor Status
==============

2004.11.24  Informed the vendor support@winamp.com, no response
2004.12.06  Tests proved winamp 5.07 is affected, informed the vendor again
2004.12.07  The vendor confirmed the vulnerability
2004.12.25  Tests proved winamp 5.08 is affected, informed the vendor
2005.01.10  The vendor released winamp 5.08c to fix the vulnerability

The vendor has released winamp 5.08c to fix this vulnerability. The latest 
version is available at http://www.winamp.com/player/

Additional Information
========================

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CAN-2004-1150 to this issue. This is a candidate for inclusion in the 
CVE list (http://cve.mitre.org), which standardizes names for security problems.
Candidates may change significantly before they become official CVE entries.

Acknowledgment
===============

Yu Yang of NSFOCUS Security Team found the vulnerability.

DISCLAIMS
==========
THE INFORMATION PROVIDED IS RELEASED BY NSFOCUS "AS IS" WITHOUT WARRANTY
OF ANY KIND. NSFOCUS DISCLAIMS ALL WARRANTIES, EITHER EXPRESSED OR IMPLIED,
EXCEPT FOR THE WARRANTIES OF MERCHANTABILITY. IN NO EVENT SHALL NSFOCUS
BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT,
INCIDENTAL,CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES,
EVEN IF NSFOCUS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
DISTRIBUTION OR REPRODUCTION OF THE INFORMATION IS PROVIDED THAT THE
ADVISORY IS NOT MODIFIED IN ANY WAY.

Copyright 1999-2005 NSFOCUS. All Rights Reserved. Terms of use.


NSFOCUS Security Team <security@nsfocus.com>
NSFOCUS INFORMATION TECHNOLOGY CO.,LTD
(http://www.nsfocus.com)

PGP Key: http://www.nsfocus.com/homepage/research/pgpkey.asc
Key fingerprint = F8F2 F5D1 EF74 E08C 02FE 1B90 D7BF 7877 C6A6 F6DA

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQFB+LIY1794d8am9toRAt5+AJ9fhmdoxO3wi4px9hPTftLUDfRllgCfYequ
nhWVWcvuVIs8339yXR+TiPU=
=yjQM
-----END PGP SIGNATURE-----

    

- 漏洞信息

12858
Winamp in_cdda.dll CDA Device Name Overflow
Input Manipulation
Loss of Integrity

- 漏洞描述

Unknown or Incomplete

- 时间线

2004-12-22 Unknow
Unknow Unknow

- 解决方案

Upgrade to version 5.08c or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

- 相关参考

- 漏洞作者

Unknown or Incomplete

- 漏洞信息

Nullsoft Winamp Variant IN_CDDA.dll Remote Buffer Overflow Vulnerability
Boundary Condition Error 12381
Yes No
2005-01-27 12:00:00 2009-07-12 10:06:00
Yu Yang of NSFOCUS Security Team is credited with the discovery of this issue.

- 受影响的程序版本

NullSoft Winamp 5.0 8
NullSoft Winamp 5.0 7
NullSoft Winamp 5.0 6
NullSoft Winamp 5.0 5
NullSoft Winamp 5.0 4
NullSoft Winamp 5.0 3
NullSoft Winamp 5.0 2
NullSoft Winamp 5.0 1
NullSoft Winamp 5.0 8c

- 不受影响的程序版本

NullSoft Winamp 5.0 8c

- 漏洞讨论

A remote buffer overflow vulnerability affects the IN_CDDA.dll library of Nullsoft's Winamp. This issue is due to a failure of the application to properly validate the length of user-supplied strings prior to copying them into finite process buffers. It should be noted that this issue is not related to the issue outlined in BID 11730 (Nullsoft Winamp IN_CDDA.dll Remote Buffer Overflow Vulnerability).

This issue will facilitate remote exploitation as an attacker may distribute malicious play-list files and entice unsuspecting users to process them with the affected application.

It should be noted that this issue was originally reported in BID 12245 (Nullsoft Winamp Multiple Unspecified Vulnerabilities). It has been assigned a new BID due to the release of more information.

An attacker may exploit this issue to execute arbitrary code with the privileges of the user that activated the vulnerable application.

- 漏洞利用

A proof of concept exploit (Winamp_POC_M3U) that is designed to spawn a local command shell has been supplied by Rojodos &lt;rojo2_bugtraqyahoo.es&gt;:

- 解决方案

The vendor has released an upgrade dealing with this issue.


NullSoft Winamp 5.0 1

NullSoft Winamp 5.0 8

NullSoft Winamp 5.0 5

NullSoft Winamp 5.0 2

NullSoft Winamp 5.0 6

NullSoft Winamp 5.0 3

NullSoft Winamp 5.0 7

NullSoft Winamp 5.0 4

- 相关参考

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站