PT-2006-1772 · Nullsoft · Winamp

Liu Yexin · Publicado 2006-02-23 · Atualizado 2018-10-19 · CVE-2006-0720

Positive Technologies (AI Summary)

CVSS v2.0

7.6

Alta

Vetor base

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Nullsoft Winamp versions 5.12 through 5.13

Description The issue is related to a stack-based buffer overflow that can be triggered by a crafted .m3u file, potentially allowing attackers to cause a denial of service or execute arbitrary code when the player pauses or stops the file. This is due to an incorrect strncpy function call.

Recommendations For Nullsoft Winamp versions 5.12 through 5.13, consider avoiding the use of .m3u files from untrusted sources until a patch is available. As a temporary workaround, restrict the playback of .m3u files to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2006-0720

Produtos afetados

Winamp

Referências · 12

• 🔥 https://exploit-db.com/exploits/26245 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24740 · Nota
• http://nsfocus.com/english/homepage/research/0601.htm · Nota
• http://forums.winamp.com/showthread.php?threadid=238648 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-0720 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0720 · Nota
• http://securityreason.com/securityalert/476 · Nota
• http://securitytracker.com/id?1015675 · Correção
• http://xforce.iss.net/xforce/xfdb/24740 · Nota
• http://securityfocus.com/archive/1/archive/1/425888/100/0/threaded · Nota
• http://securityfocus.com/archive/1/425888/100/0/threaded · Nota
• http://securityfocus.com/bid/16785 · Correção