PT-2006-1772 · Nullsoft · Winamp

Liu Yexin · Published 2006-02-23 · Updated 2018-10-19 · CVE-2006-0720

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Nullsoft Winamp versions 5.12 through 5.13

Description The issue is related to a stack-based buffer overflow that can be triggered by a crafted .m3u file, potentially allowing attackers to cause a denial of service or execute arbitrary code when the player pauses or stops the file. This is due to an incorrect strncpy function call.

Recommendations For Nullsoft Winamp versions 5.12 through 5.13, consider avoiding the use of .m3u files from untrusted sources until a patch is available. As a temporary workaround, restrict the playback of .m3u files to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2006-0720

Affected Products

Winamp

References · 12

• 🔥 https://exploit-db.com/exploits/26245 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-0720 · Security Note
• http://securitytracker.com/id?1015675 · Patch
• http://securityfocus.com/bid/16785 · Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24740 · Note
• http://nsfocus.com/english/homepage/research/0601.htm · Note
• http://forums.winamp.com/showthread.php?threadid=238648 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0720 · Note
• http://securityreason.com/securityalert/476 · Note
• http://xforce.iss.net/xforce/xfdb/24740 · Note
• http://securityfocus.com/archive/1/archive/1/425888/100/0/threaded · Note
• http://securityfocus.com/archive/1/425888/100/0/threaded · Note