Mon, Jan 30 2006 5:25 Don

Winamp Computer Name Handling Buffer Overflow Vulnerability

Description:
ATmaCA has discovered a vulnerability in Winamp, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a boundary error during the handling of filenames including a computer name. This can be exploited to cause a buffer overflow via a specially crafted playlist containing a filename starting with an overly long computer name (about 1040 bytes).

Successful exploitation allows execution of arbitrary code on a user's system when e.g. a malicious website is visited.

The vulnerability has been confirmed in version 5.12. Other versions may also be affected.

NOTE: An exploit is publicly available.

Solution:
Use another product.

Provided and/or discovered by:
ATmaCA

Original Advisory:
http://milw0rm.com/id.php?id=1458

Secunia Advisory
Filed under: