Description
Buffer overflow in Nullsoft Winamp 5.12 allows remote attackers to execute arbitrary code via a playlist (pls) file with a long file name (File1 field).
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Winamp Playlist UNC Path Computer Name Overflow
exploit/windows/browser/winamp_playlist_unc
Exploit-DB 4
- Winamp - Playlist UNC Path Computer Name Overflow (Metasploit) EDB-16531 · local · Apr 30, 2010 · verified
- Winamp 5.12 - '.pls' Remote Buffer Overflow (Perl) (2) EDB-3422 · remote · Mar 7, 2007 · verified
- Winamp 5.12 - '.pls' Remote Buffer Overflow (Metasploit) EDB-1460 · remote · Jan 31, 2006 · verified
- Winamp 5.12 - '.pls' Remote Buffer Overflow (1) EDB-1458 · remote · Jan 29, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 398 third-party-advisory
- winamp-playlist-filename-bo(24361) vdb-entry
- 386 third-party-advisory
- 1015552 vdb-entry
- 3422 exploit
- 18649 third-party-advisory
- http://www.heise.de/newsticker/meldung/68981
- ADV-2006-0361 vdb-entry
- 20060131 Re: Re: Winamp 5.12 - 0day exploit - code execution through playlist mailing-list
- oval:org.mitre.oval:def:1402 vdb-entry signature
- http://www.winamp.com/player/version_history.php
- 20060130 Winamp 5.12 - 0day exploit - code execution through playlist mailing-list
- 16410 vdb-entry
- 22789 vdb-entry
- TA06-032A third-party-advisory
- VU#604745 third-party-advisory