PT-2011-4718 · Nullsoft · Winamp

Publicado 2011-12-16 · Atualizado 2017-09-19 · CVE-2011-3834

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Winamp versions prior to 5.623

Description The issue is caused by multiple integer overflows in the in avi.dll plugin, which can be exploited by remote attackers via an AVI file with crafted values for the number of streams or the size of the RIFF INFO chunk, leading to a heap-based buffer overflow. This allows attackers to execute arbitrary code.

Recommendations For versions prior to 5.623, update to version 5.623 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the in avi.dll plugin until a patch is applied. Restrict access to AVI files from untrusted sources to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2011-3834

Produtos afetados

Winamp

Referências · 6

• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14981 · Nota
• http://forums.winamp.com/showthread.php?t=332010 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-3834 · Nota de Segurança
• http://secunia.com/advisories/46882 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3834 · Nota
• http://secunia.com/secunia_research/2011-81 · Aviso do Fabricante