<<< Date Index >>>     <<< Thread Index >>>

Re: [BuHa-Security] Winamp 5.35 (Infinite) M3U File Inclusion DoS Vulnerability



Dear bugtraq@xxxxxxxxxxxx,

 Can  you,  please explain why is this security bug? DoS is not software
 crash,  DoS  is  Denial  of  Service.  It means, security impact of DoS
 vulnerability should be preventing (blocking) access of legitimate user
 to some data or service (via data corruption, service malfuction, etc).

 In  this  case,  user  can be much easily abused in any media player by
 sending  MP3  file with some very loud sound of finger by the wet glass
 or George Bush singing in the bathroom.

--Tuesday, July 31, 2007, 1:38:41 PM, you wrote to bugtraq@xxxxxxxxxxxxxxxxx:

bmo> -----BEGIN PGP SIGNED MESSAGE-----
bmo> Hash: RIPEMD160

bmo>  ---------------------------------------------------
bmo> | BuHa Security-Advisory #15    |    Jul 30th, 2007 |
bmo>  ---------------------------------------------------
bmo> | Vendor   | Nullsoft's Winamp (Lite)               |
bmo> | URL      | http://www.winamp.com/                 |
bmo> | Version  | <= 5.35                                |
bmo> | Risk     | Low (Denial Of Service)                |
bmo>  ---------------------------------------------------

bmo> o Description:
bmo> =============

bmo> Winamp is a proprietary media player for Windows systems. Visit
bmo> http://www.winamp.com/ for detailed information.

bmo> o Denial Of Service:
bmo> ===================

bmo> The M3U file format allows it to include local and remote files by
bmo> simply specifing the path to the desired file. Furthermore Winamp does
bmo> not check if the M3U file to include is the currently processed M3U
bmo> file wherefore it's possible to force Winamp to recursively read a
bmo> certain M3U file. Winamp allocates memory by each iteration which
bmo> leads to a stack overflow exception (0xc00000fd).

bmo> You are able to simply test this bug yourself by creating a file named
bmo> 'a.m3u' with the content 'a.m3u'. If you are using the standard version
bmo> of Winamp (not the Lite version) you just have to add the M3U file to
bmo> Winamp by for example simply dragging the file into the playlist.

bmo> The lite version catches the exception and exits if you add the
bmo> malformed M3U file to the playlist. If you use the "Enqueue in Winamp"
bmo> option (if configured you'll find it in the context menu) Winamp Lite
bmo> does not catch the exception and crashes too.




-- 
~/ZARAZA http://securityvulns.com/