PT-2004-1882 · Microsoft+1 · Internet Explorer+1

Publicado 2004-08-28 · Atualizado 2017-07-11 · CVE-2004-0820

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Winamp versions prior to 5.0.4

Description The issue allows remote attackers to execute arbitrary script in the Local computer zone via script in HTML files that are referenced from XML files contained in a .wsz skin file. This flaw may allow a malicious user to execute arbitrary code when a user downloads a specifically crafted WinAmp skin from a malicious website. These skins are downloaded without prompting the user when using Internet Explorer, potentially allowing an attacker to place and execute arbitrary programs, resulting in a loss of confidentiality, integrity, or availability.

Recommendations For versions prior to 5.0.4, update to version 5.0.4 or later to resolve the issue. As a temporary workaround, consider disabling the download of .wsz skin files from untrusted sources to minimize the risk of exploitation. Restrict access to the skin download feature when using Internet Explorer to reduce the risk of arbitrary code execution.

Exploit

Correção

Identificadores relacionados

CVE-2004-0820

Produtos afetados

Internet Explorer

Winamp

Referências · 8

• 🔥 https://exploit-db.com/exploits/418 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-0820 · Nota de Segurança
• http://frsirt.com/exploits/08252004.skinhead.php · Aviso do Fabricante
• http://secunia.com/advisories/12381 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17124 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0820 · Nota
• http://auscert.org.au/render.html?it=4338 · Aviso do Fabricante
• http://xforce.iss.net/xforce/xfdb/17124 · Nota