SecurityReason.com - Our Reason is

Security

Register | Forget Password | Login
SecurityReason
WLB
Services
RSS
Corporate
Note

If you have found a vulnerability, please send to our SecurityAlert Database :
secalert()securityreason()com

Also if you have new ( 0-day ) exploit, please send to our ExploitAlert Archive :
exploit()securityreason()com

Home arrow SecurityAlert Database

Arrow  Topic :

Winamp m3u File Processing Buffer Overflow Vulnerability


Arrow  SecurityAlert : 476
Arrow  CVE : CVE-2006-0720
Arrow  SecurityRisk : Medium  Security Risk Medium  (About)
Arrow  Remote Exploit : Yes
Arrow  Local Exploit : Yes
Arrow  Exploit Available : No
Arrow  Credit : NSFOCUS Security Team
Arrow  Published : 23.02.2006

Arrow  Affected Software : Nullsoft Winamp 5.12
Nullsoft Winamp 5.13



Arrow  Advisory Content :  

NSFOCUS Security Advisory (SA2006-01)

Winamp m3u File Processing Buffer Overflow Vulnerability

Release Date: 2006-02-23

CVE ID: CVE-2006-0720

http://www.nsfocus.com/english/homepage/research/0601.htm

Affected systems & software
===========================

Nullsoft Winamp 5.12
Nullsoft Winamp 5.13

Unaffected systems & software
=============================

Nullsoft Winamp 5.2

Summary
=========

Winamp is a popular media player that supports various media formats and
playlist formats, including m3u and pls formats.

NSFocus Security Team discovered a buffer overflow vulnerability when
Winamp
processes .m3u files, which might cause Winamp to crash or even execute
arbitrary code when a user load a malicious .m3u file and play.

Description
============

Winamp can play files by loading .m3u file. When the playing is paused or
stopped,
Winamp will reset the title of the program, where function strncpy() is
incorrectly
called, resulting in a static buffer overflow.

An attacker can cause winamp to crash by crafting a malicious .m3u file.
Remote code execution is possible but difficult.

Workaround
=============

Cancel .m3u file association to Winamp, and do not open untrusted .m3u
files.

Vendor Status
==============

2006.02.13 Informed the vendor.
2006.02.15 The vendor confirmed the vulnerability.
2006.02.21 The vendor releases a new version to fix the vulnerability.

The vendor has released Winamp 5.2 to fix this vulnerability, which is
available
for download at:
http://www.winamp.com/player/
http://forums.winamp.com/showthread.php?threadid=238648

Additional Information
========================

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2006-0720 to this issue. This is a candidate for inclusion in the
CVE list (http://cve.mitre.org), which standardizes names for security
problems.
Candidates may change significantly before they become official CVE
entries.

Acknowledgment
===============

Liu Yexin of NSFocus Security Team found the vulnerability.

DISCLAIMS
==========
THE INFORMATION PROVIDED IS RELEASED BY NSFOCUS "AS IS" WITHOUT WARRANTY
OF ANY KIND. NSFOCUS DISCLAIMS ALL WARRANTIES, EITHER EXPRESSED OR IMPLIED,
EXCEPT FOR THE WARRANTIES OF MERCHANTABILITY. IN NO EVENT SHALL NSFOCUS
BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT,
INCIDENTAL,CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES,
EVEN IF NSFOCUS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
DISTRIBUTION OR REPRODUCTION OF THE INFORMATION IS PROVIDED THAT THE
ADVISORY IS NOT MODIFIED IN ANY WAY.

Copyright 1999-2006 NSFOCUS. All Rights Reserved. Terms of use.

NSFOCUS Security Team <security (at) nsfocus (dot) com [email concealed]>
NSFOCUS INFORMATION TECHNOLOGY CO.,LTD
(http://www.nsfocus.com)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)

iD8DBQBD/Vgo1794d8am9toRAjjLAKCJyCZ4QBGQBVVtisBXkrJ7hmSJ6QCeJbhT
3PSlkDWxaJzBbabGF/wJ3nQ=
=8x9O
-----END PGP SIGNATURE-----





Arrow  Feedback :

If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com.
Alert

libc/fnmatch(3) DoS

Security Risk Medium- 2011-05-13

Allow attacker to denial of service apache 2.2.17 server

Apache RSS Apache Alert

» Apache HTTP Server Denial
   of Service Vulnerability

» Multiple Vendors
   libc/fnmatch(3) DoS (incl
   apache poc)

» Apache Continuum
   cross-site scripting
   vulnerability

» Apache Tomcat DoS
   Vulnerability

PHP RSS PHP Alert

» PHP Hashtables Denial of
   Service

» PHP 5.3.6 multiple null
   pointer dereference

» PHP 5.3.6 ZipArchive
   invalid use glob(3)

» libzip 0.9.3
   _zip_name_locate NULL
   Pointer Dereference (incl
   PHP 5.3.5)

ADT

Protect your family and valuables with Home Security Systems

Copyright © SecurityReason.com. All Rights Reserved.