PT-2004-1882 · Microsoft+1 · Internet Explorer+1

Published 2004-08-28 · Updated 2017-07-11 · CVE-2004-0820

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Winamp versions prior to 5.0.4

Description The issue allows remote attackers to execute arbitrary script in the Local computer zone via script in HTML files that are referenced from XML files contained in a .wsz skin file. This flaw may allow a malicious user to execute arbitrary code when a user downloads a specifically crafted WinAmp skin from a malicious website. These skins are downloaded without prompting the user when using Internet Explorer, potentially allowing an attacker to place and execute arbitrary programs, resulting in a loss of confidentiality, integrity, or availability.

Recommendations For versions prior to 5.0.4, update to version 5.0.4 or later to resolve the issue. As a temporary workaround, consider disabling the download of .wsz skin files from untrusted sources to minimize the risk of exploitation. Restrict access to the skin download feature when using Internet Explorer to reduce the risk of arbitrary code execution.

Exploit

Fix

Related Identifiers

CVE-2004-0820

Affected Products

Internet Explorer

Winamp

References · 8

• 🔥 https://exploit-db.com/exploits/418 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-0820 · Security Note
• http://frsirt.com/exploits/08252004.skinhead.php · Vendor Advisory
• http://secunia.com/advisories/12381 · Vendor Advisory
• http://auscert.org.au/render.html?it=4338 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17124 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0820 · Note
• http://xforce.iss.net/xforce/xfdb/17124 · Note