Old 26th August 2004, 07:08   #1
Mgz
Junior Member
 
Join Date: Nov 2002
Posts: 34
Security bug in Winamp 5.04(from secunia.com)

Quote:
Description:
A vulnerability has been reported in Winamp, which can be exploited by malicious people to compromise a user's system.

The problem is caused due to insufficient restrictions on Winamp skin zip files (.wsz). This can e.g. be exploited by a malicious website using a specially crafted Winamp skin to place and execute arbitrary programs. With Internet Explorer this can be done without user interaction.

An XML document in the Winamp skin zip file can reference a HTML document using the "browser" tag and get it to run in the "Local computer zone". This can be exploited to run an executable program embedded in the Winamp skin file using the "object" tag and the "codebase" attribute.

NOTE: The vulnerability is reportedly being exploited in the wild.

The vulnerability has been confirmed on a fully patched system with Winamp 5.04 using Internet Explorer 6.0 on Microsoft Windows XP SP1.

Solution:
Use another product.
link - http://secunia.com/advisories/12381
Mgz is offline  
Old 26th August 2004, 07:12   #2
drewbar
Sawg 2.0
Major Dude
 
Join Date: Mar 2004
Posts: 5,916
Please search for posting:
http://forums.winamp.com/showthread....hreadid=190902
http://forums.winamp.com/showthread....hreadid=191216

Know issues and the fix is currently being tested and should be released sometime soon.

Count with us!
Jan 1st, 12AM (PST, GMT -8) 2010 - 282,246
drewbar is offline  
Old 26th August 2004, 10:13   #3
Mgz
Junior Member
 
Join Date: Nov 2002
Posts: 34
Quote:
Originally posted by drewbar
Please search for posting:
http://forums.winamp.com/showthread....hreadid=190902
http://forums.winamp.com/showthread....hreadid=191216

Know issues and the fix is currently being tested and should be released sometime soon.
sorry

I DID search with keyword "secunia"

you can close or delete this thread now
Mgz is offline  
Closed Thread
Go Back   Winamp & Shoutcast Forums > Winamp > Winamp Bug Reports

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump