PT-2006-1542 · Nullsoft · Nullsoft Winamp

Atmaca · Published 2006-01-31 · Updated 2018-10-19 · CVE-2006-0476

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Nullsoft Winamp version 5.12

Description A buffer overflow issue allows remote attackers to execute arbitrary code via a playlist (pls) file with a long file name in the File1 field.

Recommendations For Nullsoft Winamp version 5.12, consider avoiding the use of playlist files with long file names in the File1 field until a patch is available. As a temporary workaround, restrict the processing of such files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Related Identifiers

CVE-2006-0476

Affected Products

Nullsoft Winamp

References · 29

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/winamp_playlist_unc.rb · Exploit
• 🔥 https://exploit-db.com/exploits/3422 · Exploit
• 🔥 https://exploit-db.com/exploits/1460 · Exploit
• 🔥 https://exploit-db.com/exploits/16531 · Exploit
• 🔥 https://exploit-db.com/exploits/1458 · Exploit
• http://secunia.com/advisories/18649 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0476 · Security Note
• http://securityfocus.com/archive/1/archive/1/423548/100/0/threaded · Note
• http://securityreason.com/securityalert/398 · Note
• http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1402 · Note
• http://securityfocus.com/archive/1/423436/100/0/threaded · Note
• http://winamp.com/player/version_history.php · Note
• http://milw0rm.com/id.php?id=1458 · Note
• http://securityfocus.com/archive/1/423548/100/0/threaded · Note
• http://heise.de/newsticker/meldung/68981 · Note