The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
AOL Nullsoft Winamp Ultravox 'ultravox-max-msg' Header Heap Overflow
------------------------------------------------------------------------
SUMMARY
Ultravox is "a streaming media technology developed by AOL for delivering
and publishing streaming media such as music files. The Winamp media
player has support for this protocol". Remote exploitation of a heap-based
buffer overflow vulnerability in the Ultravox protocol handler of AOL
Corp.'s Nullsoft Winamp media player could allow an attacker to execute
arbitrary code in the context of the currently logged in user.
DETAILS
Vulnerable Systems:
* Winamp version 5.24
* Winamp version 5.3
Immune Systems:
* Winamp version 5.31
Due to an error in the handling of the 'ultravox-max-msg' header, it is
possible for a malicious server to cause the Winamp client to allocate a
very small amount of space and then try fill it with a large amount of
server supplied date, potentially overwriting values which will lead to
code execution.
Analysis:
Successful exploitation of this vulnerability would allow a remote
attacker to execute code in the context of the user who started Winamp. In
order to exploit this vulnerability, the attacker would need to cause or
convince the intended victim to connect to a malicious server. This could
be accomplished by embedding a link in a web page to a playlist file, a
'shout:' URI or a 'uvox:' URI, which are automatically by Winamp from
Internet Explorer. Alternatively, one of these items could be placed in a
playlist file. The attacker would have no way to force the user to open
the content they have supplied.
Disclosure Timeline:
10/19/2006 - Initial vendor notification
10/25/2006 - Initial vendor response
10/25/2006 - Coordinated public disclosure
ADDITIONAL INFORMATION
The information has been provided by
<mailto:idlabs-advisories@idefense.com> iDefense Labs Security Advisories.
The original article can be found at:
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=431>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=431
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
