Re: Winamp 5.12 - 0day exploit - code execution through playlist

To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: Re: Winamp 5.12 - 0day exploit - code execution through playlist
From: bart sikkes <b.sikkes@xxxxxxxxx>
Date: Tue, 31 Jan 2006 10:49:47 +0100
Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=XjKdbNv5M6qnFErJ8OBaJRzeXzryIOt/mXqCyAq9w90xyRccC3QIqi1GPEAvApqex0WvVW6CZwki75ZZkphk4VjAnU/p8Iaedopi/L2LQ4yCOkcO/hWyEiz40O/bEwXxD6L6Lk+Nn4pTTOL4T33QDkzuGJYG8lRd6exUXh0HdCo=
In-reply-to: <Pine.BSO.4.55.0601301416330.20410@xxxxxxxxxxxxxxxxxxx>
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
References: <43DE2A00.8090106@xxxxxxxxxxxxxx> <Pine.BSO.4.55.0601301416330.20410@xxxxxxxxxxxxxxxxxxx>

> You can disable auto launching Winamp for playlist files as a workaround.

sans claimed that certain workarounds weren't full proof either.
anyway winamp released version 5.13 that should fix this, that seems
the best thing to do.

bart

References:
- Winamp 5.12 - 0day exploit - code execution through playlist
  - From: Process
- Re: Winamp 5.12 - 0day exploit - code execution through playlist
  - From: Chris Wysopal

Prev by Date: Re: Trend Micro ServerProtect version 5.58 can be easily circumvented via the mechanism that limits how many files to scan.
Next by Date: Re: AOL Instant Messenger Version 5.9.3861 Local Buffer Overrun Vulnerability
Previous by thread: Re: Winamp 5.12 - 0day exploit - code execution through playlist
Next by thread: Re: Re: Winamp 5.12 - 0day exploit - code execution through playlist
Index(es):
- Date
- Thread