PT-2007-3267 · Nullsoft · Winamp

Publicado 2007-04-10 · Atualizado 2018-10-16 · CVE-2007-1922

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Winamp version 5.33

Description The issue allows remote attackers to execute arbitrary code via crafted files. Specifically, it affects the Impulse Tracker (IT) and ScreamTracker 3 (S3M) modules in IN MOD.DLL, where integer values in (1) .IT or (2) .S3M files are used as memory offsets, leading to memory corruption.

Recommendations For Winamp version 5.33, consider disabling the use of .IT and .S3M modules until a patch is available to prevent potential exploitation. Restrict access to these modules to minimize the risk of arbitrary code execution. Avoid using the affected IN MOD.DLL to handle .IT and .S3M files until the issue is resolved.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2007-1922

Produtos afetados

Winamp

Referências · 19

• http://securityfocus.com/archive/1/464890/100/0/threaded · Nota
• http://securityreason.com/securityalert/2532 · Nota
• http://securityfocus.com/archive/1/archive/1/464893/100/0/threaded · Nota
• http://vupen.com/english/advisories/2007/1286 · Nota
• http://piotrbania.com/all/adv/nullsoft-winamp-s3m_module-in_mod-adv.txt · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33480 · Nota
• http://osvdb.org/34430 · Nota
• http://osvdb.org/34431 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1922 · Nota de Segurança
• http://securityfocus.com/bid/23350 · Nota
• http://securityfocus.com/archive/1/archive/1/464890/100/0/threaded · Nota
• http://piotrbania.com/all/adv/nullsoft-winamp-it_module-in_mod-adv.txt · Aviso do Fabricante
• http://marc.info/?l=dailydave&m=117589949000906&w=2 · Nota
• http://frsirt.com/english/advisories/2007/1286 · Nota
• http://xforce.iss.net/xforce/xfdb/33480 · Nota