Highly Critical Hole In Winamp

[sharedholder]

WinAmp music to hackers' ears

"highly critical" hole in one of the most-used pieces of software in the world means that audio files will be music to hackers' ears.

The ubiquitous WinAmp program - used to play a huge range of media files - can provide someone with system access simply by getting someone to visit a malicious website. It all has to do with how the software loads Fasttracker 2 ".xm" media files.

It is possible to cause a heap overflow and so run code on the person's system. A ".xm" file is not needed however, as the software runs through all supported files with the same faulty piece of code. This greatly increases the opportunities hackers may have to con someone into clicking a link and so providing them with system access.

The flaw affects all WinAmps and so the only advice is to upgrade as soon as possible to the new patched version (5.03)

WinAmp in its various forms has been downloaded tens of millions of times and has a huge installed base. It can deal with 30 different file types and has hundreds of plug-ins.

The hole was found by NGSSoftware and you can find out a lot more about it, plus details to fill in the hole without having to upgrade here

[4th gen]

/me pats QCD Player on the head

[sharedholder]

Originally posted by 4th gen@6 April 2004 - 12:23
/me pats QCD Player on the head

Or FOOBAR ( my case )

[delphin460]

again i cant understand why ppl would surf with those internal web browsers, like in the kliteapp and win amp ect

why do ppl think its taken so long to get even IE close to being right

my advise is never use in app browsers at all man

[Mullyman]

Why don"t you just post the site and give credit to the person who wrote the article..instead of coping it

http://www.techworld.com/security/ne...fm?NewsID=1343

[uNz[i]]

Another feckin' update?
Maybe I'll upgrade on the weekend.. this'll do till then...

Originally posted by SH's link
it is possible to disable the handling of Fasttracker 2 module files by taking the following steps:

1. Right click the Winamp player, go to 'Options' and then to 'Preferences...'.

2. In the new window which loads, go to 'Plug-ins' and 'Input'.

3. Look for the input plug-in items 'Nullsoft Module Decoder' and double click it to bring up the 'Nullsoft Module Decoder Preferences' window.

4. Select the 'Fasttracker 2' loader and deselect the 'Enabled' checkbox to the right of the loaders list.

5. Close all of the option windows and return to the main player.

Thanks for the heads up SH.