[NT] AOL Nullsoft Winamp Ultravox Lyrics3 v2.00 tags Heap Overflow

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



AOL Nullsoft Winamp Ultravox Lyrics3 v2.00 tags Heap Overflow
------------------------------------------------------------------------


SUMMARY

Lyrics3 is "a system for embedding the lyrics inside an MP3 song file. The
Winamp media player has support for this protocol". Remote exploitation of
a heap-based buffer overflow vulnerability in the Ultravox Lyrics3 parsing
code in AOL Corp.'s Nullsoft Winamp media player could allow an attacker
to execute arbitrary code in the context of the currently logged in user.

DETAILS

Vulnerable Systems:
* Winamp version 5.24
* Winamp version 5.3

Immune Systems:
* Winamp version 5.31

Due to an error in the parsing of certain Lyrics3 tags, a malicious server
can cause the Winamp client to allocate a very small amount of space and
then try fill it with a large amount of server supplied date, potentially
overwriting values which will lead to code execution.

Analysis:
Exploitation allows remote attackers to execute code in the context of the
user who started Winamp. Exploitation requires that attackers social
engineer victims into connecting to a server. This can be accomplished by
embedding a link in a web page to a playlist file, a 'shout:' URI or a
'uvox:' URI, which are automatically loaded by Winamp from Internet
Explorer. Alternatively, one of these items could be placed in a playlist
file. However, attackers cannot force users to open the content they have
supplied.

Disclosure Timeline:
10/19/2006 - Initial vendor notification
10/25/2006 - Initial vendor response
10/25/2006 - Coordinated public disclosure


ADDITIONAL INFORMATION

The information has been provided by
<mailto:idlabs-advisories@xxxxxxxxxxxx> iDefense Labs Security Advisories.
The original article can be found at:
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=432>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=432



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [NT] Winamp playlist Buffer Overflow
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Winamp playlist Buffer Overflow ... A buffer overflow within Winamp .pls playlist file allows attackers to ... Bug discovered & exploit coded by ATmaCA ...
    (Securiteam)
  • [NT] AOL Nullsoft Winamp Ultravox ultravox-max-msg Header Heap Overflow
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... AOL Nullsoft Winamp Ultravox 'ultravox-max-msg' Header Heap Overflow ... Corp.'s Nullsoft Winamp media player could allow an attacker to execute ...
    (Securiteam)
  • [EXPL] Winamp IN_CDDA.dll Remote Buffer Overflow Exploit
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... allows attackers to cause Winamp to execute arbitrary code by overflowing ... //50 PUSH EAX; Null Pointer ... printf ...
    (Securiteam)
  • [NT] Multiple Vulnerabilities in WinAMP (MP4 and NSV files)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Winamp is a popular media player for Microsoft ... There is a vulnerability in WinAMP's handling of .mp4 and .m4a files. ...
    (Securiteam)
  • [UNIX] GPhotos Multiple Vulnerabilities
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... GPhotos Multiple Vulnerabilities ... as allow attackers to insert arbitrary HTML and/or JavaScript. ...
    (Securiteam)