HTTP: Winamp ID3v2 Tag Handling Buffer Overflow

This signature detects the download of a maliciously crafted MPEG music file (.mp3, .mp2, etc). If opened in Nullsoft WinAmp, the file can exploit a vulnerability that allows for the execution of arbitrary commands on the client. It is reported that Nullsoft WinAmp versions 5.091 and prior are affected.

Extended Description

Winamp is susceptible to a buffer overflow vulnerability in its ID3v2 functionality. This issue is due to a failure of the application to properly bounds check input data prior to copying it into a fixed size memory buffer. This issue will facilitate remote exploitation as an attacker may distribute malicious MP3 files and entice unsuspecting users to process them with the affected application. An attacker may exploit this issue to execute arbitrary code with the privileges of the user that activated the vulnerable application. Versions 5.03a, 5.09, and 5.091 are reported vulnerable to this issue. Other versions are also likely affected.

Affected Products

Nullsoft winamp

References

BugTraq: 14276

CVE: CVE-2005-2310

URL: http://securitytracker.com/id?1014483

Short Name

HTTP:STC:WINAMP:ID3V2-OVERFLOW

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Winamp ID3v2 Tag Handling Buffer Overflow

Extended Description

Affected Products

References

Found a potential security threat?