Thursday, September 18, 2014
Search
  
Submit your own News for
inclusion in our Site.
Click here...
Breaking News
Dropbox, Google, Open Technology Fund, Security Researchers Announce Simply Secure
Apple And U2 To Develop New Digital Music Format
AT&T Launches High-speed U-verse Service for Businesses
AMD Moves Closer To The Introduction Of Project FreeSync Monitors
Ericsson to Shut Modem Business
VIA Launches ARTiGO A900 Android System For IoT and M2M Deployments
Amazon Purchases .buy Domain for 4.6 Million Dollars
Toshiba to Develop New Transistor Series Using Latest Process Technology
Active Discussions
Yamaha CRW-F1UX
help questions structure DVDR
Made video, won't play back easily
Questions durability monitor LCD
Questions fungus CD/DVD Media, Some expert engineer in optical media can help me?
CD, DVD and Blu-ray burning for Android in development
IBM supercharges Power servers with graphics chips
Werner Vogels: four cloud computing trends for 2014
 Home > News > General Computing > WinAmp ...
Last 7 Days News : SU MO TU WE TH FR SA All News

Thursday, November 25, 2004
WinAmp blows another security fuse


For those enterprise IT managers who've been eagerly anticipating the next major WinAmp security flaw, the wait is over. Brett Moore of Security-Assessment.com on Tuesday published details of a security hole allowing attackers to take over a PC when a user visits a specially crafted Web page.

The bug, a boundary error in the "IN_CDDA.dll" file, is the latest in a string of serious vulnerabilities in WinAmp, including an August flaw in the handling of "skin" files which attackers began to exploit before it had been discovered by researchers. The new bug, the skin file flaw and an April flaw in the handling of ".xm" files could all be exploited by luring an affected user to a website containing a specific type of file, which would then be automatically downloaded and executed.

This week's bug can be exploited in a number of ways, the most dangerous being via an ".m3u" playlist file, according to Moore. "When hosted on a website, these files will be automatically downloaded and opened in winamp without any user interaction," he wrote in Security-Assessment.com's advisory. "This is enough to cause the overflow that would allow a malicious playlist to overwrite EIP and execute arbitrary code."

Nullsoft, part of America Online, has patched the bug in WinAmp version 5.06, available from the company's website. Danish security firm Secunia, which maintains a vulnerabilities database, said the bug was "highly critical", its second most serious ranking.

The August vulnerability was WinAmp's most serious this year because it was exploited before a patch was available. While not as widely used as Windows Media Player or RealPlayer, WinAmp has an installed base of several million, including on corporate desktops, according to the company. The bug affected version 5.04, which was only a month old at the time.


Previous
Next
Dell intros high-end gaming PC        All News        Opera resizes the web in beta browser
Dell intros high-end gaming PC     General Computing News      Opera resizes the web in beta browser

Get RSS feed Easy Print E-Mail this Message

Related News
Radionomy Acquires Winamp and Shoutcast
End Of An Era For Winamp

Most Popular News
 
Home | News | All News | Reviews | Articles | Guides | Download | Expert Area | Forum | Site Info
Site best viewed at 1024x768+ - CDRINFO.COM 1998-2014 - All rights reserved -
Privacy policy - Contact Us .