PT-2012-5164 · Nullsoft · Winamp

Publicado 2012-07-22 · Atualizado 2017-09-19 · CVE-2012-4045

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Winamp versions prior to 5.63 build 3235

Description The issue is related to multiple heap-based buffer overflows in the bmp.w5s component. This can be exploited by remote attackers to execute arbitrary code through various means, including the strf chunk in BI RGB, UYVY video data in an AVI file, or decompressed TechSmith Screen Capture Codec (TSCC) data in an AVI file.

Recommendations For versions prior to 5.63 build 3235, update to version 5.63 build 3235 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the bmp.w5s component or restricting access to AVI files until the update is applied.

Correção

RCE

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2012-4045

Produtos afetados

Winamp

Referências · 6

• http://forums.winamp.com/showthread.php?t=345684 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4045 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-4045 · Nota de Segurança
• http://securityfocus.com/bid/54131 · Nota
• http://secunia.com/advisories/46624 · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15335 · Nota