PT-2006-6282 · Nullsoft · Winamp

Published 2006-10-27 · Updated 2017-10-11 · CVE-2006-5567

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: WinAmp versions prior to 5.31

Description: The issue is related to multiple heap-based buffer overflows that can be triggered by a crafted ultravox-max-msg header to the Ultravox protocol handler or unspecified Lyrics3 tags, allowing user-assisted remote attackers to execute arbitrary code.

Recommendations: For versions prior to 5.31, update to version 5.31 or later to resolve the issue. As a temporary workaround, consider disabling the Ultravox protocol handler until a patch is available. Restrict access to Lyrics3 tags to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2006-5567

Affected Products

Winamp

References · 18

• 🔥 https://exploit-db.com/exploits/2708 · Exploit
• http://secunia.com/advisories/22580 · Vendor Advisory
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=431 · Vendor Advisory
• http://securityfocus.com/bid/20744 · Patch
• http://securitytracker.com/id?1017120 · Patch
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=432 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-5567 · Security Note
• http://securitytracker.com/id?1017119 · Note
• http://kb.cert.org/vuls/id/449092 · Note
• http://xforce.iss.net/xforce/xfdb/29807 · Note
• http://vupen.com/english/advisories/2006/4196 · Note
• http://frsirt.com/english/advisories/2006/4196 · Note
• http://winamp.com/player/version_history.php#5.31 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5567 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15686 · Note