PT-2006-6282 · Nullsoft · Winamp

Publicado 2006-10-27 · Atualizado 2017-10-11 · CVE-2006-5567

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: WinAmp versions prior to 5.31

Description: The issue is related to multiple heap-based buffer overflows that can be triggered by a crafted ultravox-max-msg header to the Ultravox protocol handler or unspecified Lyrics3 tags, allowing user-assisted remote attackers to execute arbitrary code.

Recommendations: For versions prior to 5.31, update to version 5.31 or later to resolve the issue. As a temporary workaround, consider disabling the Ultravox protocol handler until a patch is available. Restrict access to Lyrics3 tags to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2006-5567

Produtos afetados

Winamp

Referências · 18

• 🔥 https://exploit-db.com/exploits/2708 · Exploit
• http://securitytracker.com/id?1017119 · Nota
• http://secunia.com/advisories/22580 · Aviso do Fabricante
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=431 · Aviso do Fabricante
• http://securityfocus.com/bid/20744 · Correção
• http://kb.cert.org/vuls/id/449092 · Nota
• http://xforce.iss.net/xforce/xfdb/29807 · Nota
• http://vupen.com/english/advisories/2006/4196 · Nota
• http://frsirt.com/english/advisories/2006/4196 · Nota
• http://winamp.com/player/version_history.php#5.31 · Nota
• http://securitytracker.com/id?1017120 · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5567 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15686 · Nota
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=432 · Aviso do Fabricante
• http://xforce.iss.net/xforce/xfdb/29804 · Nota