PT-2009-2931 · Nullsoft · Winamp

Securfrog · Published 2009-01-23 · Updated 2017-10-19 · CVE-2009-0263

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Winamp versions 5.541 and earlier

Description The issue is caused by a boundary error in the processing of AIFF files, leading to a heap-based buffer overflow. This can be exploited via a large Common Chunk (COMM) header value in an AIFF file or a large invalid value in an MP3 file, potentially allowing remote attackers to cause a denial of service and possibly execute arbitrary code.

Recommendations For Winamp versions 5.541 and earlier, consider updating to a newer version to mitigate the risk of exploitation. As a temporary workaround, restrict the processing of AIFF and MP3 files to minimize the risk of a heap-based buffer overflow. Avoid using the COMM header value in AIFF files and invalid values in MP3 files until the issue is resolved.

Exploit

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2009-0263

Affected Products

Winamp

References · 7

• 🔥 https://exploit-db.com/exploits/7742 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-0263 · Security Note
• http://securityfocus.com/bid/33226 · Note
• http://vupen.com/english/advisories/2009/0113 · Note
• http://secunia.com/advisories/33478 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14756 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0263 · Note