[NT] AOL Nullsoft Winamp Ultravox 'ultravox-max-msg' Header Heap Overflow

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



AOL Nullsoft Winamp Ultravox 'ultravox-max-msg' Header Heap Overflow
------------------------------------------------------------------------


SUMMARY

Ultravox is "a streaming media technology developed by AOL for delivering
and publishing streaming media such as music files. The Winamp media
player has support for this protocol". Remote exploitation of a heap-based
buffer overflow vulnerability in the Ultravox protocol handler of AOL
Corp.'s Nullsoft Winamp media player could allow an attacker to execute
arbitrary code in the context of the currently logged in user.

DETAILS

Vulnerable Systems:
* Winamp version 5.24
* Winamp version 5.3

Immune Systems:
* Winamp version 5.31

Due to an error in the handling of the 'ultravox-max-msg' header, it is
possible for a malicious server to cause the Winamp client to allocate a
very small amount of space and then try fill it with a large amount of
server supplied date, potentially overwriting values which will lead to
code execution.

Analysis:
Successful exploitation of this vulnerability would allow a remote
attacker to execute code in the context of the user who started Winamp. In
order to exploit this vulnerability, the attacker would need to cause or
convince the intended victim to connect to a malicious server. This could
be accomplished by embedding a link in a web page to a playlist file, a
'shout:' URI or a 'uvox:' URI, which are automatically by Winamp from
Internet Explorer. Alternatively, one of these items could be placed in a
playlist file. The attacker would have no way to force the user to open
the content they have supplied.

Disclosure Timeline:
10/19/2006 - Initial vendor notification
10/25/2006 - Initial vendor response
10/25/2006 - Coordinated public disclosure


ADDITIONAL INFORMATION

The information has been provided by
<mailto:idlabs-advisories@xxxxxxxxxxxx> iDefense Labs Security Advisories.
The original article can be found at:
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=431>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=431



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [NT] Winamp playlist Buffer Overflow
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Winamp playlist Buffer Overflow ... A buffer overflow within Winamp .pls playlist file allows attackers to ... Bug discovered & exploit coded by ATmaCA ...
    (Securiteam)
  • [NT] AOL Nullsoft Winamp Ultravox Lyrics3 v2.00 tags Heap Overflow
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... AOL Nullsoft Winamp Ultravox Lyrics3 v2.00 tags Heap Overflow ... Exploitation allows remote attackers to execute code in the context of the ...
    (Securiteam)
  • [EXPL] Winamp IN_CDDA.dll Remote Buffer Overflow Exploit
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... allows attackers to cause Winamp to execute arbitrary code by overflowing ... //50 PUSH EAX; Null Pointer ... printf ...
    (Securiteam)
  • [NT] Multiple Vulnerabilities in WinAMP (MP4 and NSV files)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Winamp is a popular media player for Microsoft ... There is a vulnerability in WinAMP's handling of .mp4 and .m4a files. ...
    (Securiteam)
  • [UNIX] phpSysInfo Multiple Vulnerabilities (HTTP_ACCEPT_LANGUAGE, sensor_program, VERSION, charset)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Multiple vulnerabilities have been discovered in phpSysInfo allowing ... the attacker to additionally inject the $lng parameter. ... $sensor_program can *still* be used to inject active ...
    (Securiteam)