Breaking News

Thermaltake Launches AW360/420 AIO Liquid Cooler and WAir CPU Cooler for Workstations be quiet! redefines versatility with new Light Base 500 LX and Light Base 500 PC cases Crucial’s UK promos for Amazon’s Prime Day Deals 2025 JEDEC Sets the Stage for the Next Leap in Flash Storage With UFS 5.0 MSI Launches Its First Back-Connection Graphics Card—GeForce RTX 5070 Ti 16G VENTUS 3X PZ Series

logo

  • Share Us
    • Facebook
    • Twitter
  • Home
  • Home
  • News
  • Reviews
  • Essays
  • Forum
  • Legacy
  • About
    • Submit News

    • Contact Us
    • Privacy

    • Promotion
    • Advertise

    • RSS Feed
    • Site Map

Search form

WinAmp blows another security fuse

WinAmp blows another security fuse

Enterprise & IT Nov 25,2004 0

For those enterprise IT managers who've been eagerly anticipating the next major WinAmp security flaw, the wait is over. Brett Moore of Security-Assessment.com on Tuesday published details of a security hole allowing attackers to take over a PC when a user visits a specially crafted Web page. The bug, a boundary error in the "IN_CDDA.dll" file, is the latest in a string of serious vulnerabilities in WinAmp, including an August flaw in the handling of "skin" files which attackers began to exploit before it had been discovered by researchers. The new bug, the skin file flaw and an April flaw in the handling of ".xm" files could all be exploited by luring an affected user to a website containing a specific type of file, which would then be automatically downloaded and executed.

This week's bug can be exploited in a number of ways, the most dangerous being via an ".m3u" playlist file, according to Moore. "When hosted on a website, these files will be automatically downloaded and opened in winamp without any user interaction," he wrote in Security-Assessment.com's advisory. "This is enough to cause the overflow that would allow a malicious playlist to overwrite EIP and execute arbitrary code."

Nullsoft, part of America Online, has patched the bug in WinAmp version 5.06, available from the company's website. Danish security firm Secunia, which maintains a vulnerabilities database, said the bug was "highly critical", its second most serious ranking.

The August vulnerability was WinAmp's most serious this year because it was exploited before a patch was available. While not as widely used as Windows Media Player or RealPlayer, WinAmp has an installed base of several million, including on corporate desktops, according to the company. The bug affected version 5.04, which was only a month old at the time.

Tags: winamp
Previous Post
Dell intros high-end gaming PC
Next Post
Opera resizes the web in beta browser

Related Posts

  • Radionomy Acquires Winamp and Shoutcast

  • End Of An Era For Winamp

Latest News

Thermaltake Launches AW360/420 AIO Liquid Cooler and WAir CPU Cooler for Workstations
Cooling Systems

Thermaltake Launches AW360/420 AIO Liquid Cooler and WAir CPU Cooler for Workstations

be quiet! redefines versatility with new Light Base 500 LX and Light Base 500 PC cases
Cooling Systems

be quiet! redefines versatility with new Light Base 500 LX and Light Base 500 PC cases

Crucial’s UK promos for Amazon’s Prime Day Deals 2025
Consumer Electronics

Crucial’s UK promos for Amazon’s Prime Day Deals 2025

JEDEC Sets the Stage for the Next Leap in Flash Storage With UFS 5.0
Cameras

JEDEC Sets the Stage for the Next Leap in Flash Storage With UFS 5.0

MSI Launches Its First Back-Connection Graphics Card—GeForce RTX 5070 Ti 16G VENTUS 3X PZ Series
GPUs

MSI Launches Its First Back-Connection Graphics Card—GeForce RTX 5070 Ti 16G VENTUS 3X PZ Series

Popular Reviews

be quiet! Dark Mount Keyboard

be quiet! Dark Mount Keyboard

Terramaster F8-SSD

Terramaster F8-SSD

be quiet! Light Mount Keyboard

be quiet! Light Mount Keyboard

be quiet! Light Base 600 LX

be quiet! Light Base 600 LX

be quiet! Pure Base 501

be quiet! Pure Base 501

Soundpeats Pop Clip

Soundpeats Pop Clip

Akaso 360 Action camera

Akaso 360 Action camera

Dragon Touch Digital Calendar

Dragon Touch Digital Calendar

Main menu

  • Home
  • News
  • Reviews
  • Essays
  • Forum
  • Legacy
  • About
    • Submit News

    • Contact Us
    • Privacy

    • Promotion
    • Advertise

    • RSS Feed
    • Site Map
  • About
  • Privacy
  • Contact Us
  • Promotional Opportunities @ CdrInfo.com
  • Advertise on out site
  • Submit your News to our site
  • RSS Feed