PT-2002-1354 · Nullsoft · Winamp

Published 2002-05-03 · Updated 2016-10-18 · CVE-2002-0284

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Winamp versions 2.77 through 2.78

Description The issue allows malicious web servers to obtain the pathname of the Temporary Internet Files directory when a wma file requiring a license is opened. This occurs because the full path of the Temporary Internet Files directory is sent to the web page processing the license.

Recommendations For versions 2.77 and 2.78, consider restricting access to the license processing web page to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2002-0284

Affected Products

Winamp

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2002-0284 · Security Note
• http://marc.info/?l=bugtraq&m=101408781031527&w=2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0284 · Note
• http://marc.theaimsgroup.com/?l=bugtraq&m=101408781031527&w=2 · Note