HTTP: Nullsoft Winamp M3U Remote Buffer Overflow

This signature detects attempts to exploit a known vulnerability in the M3U file parsing component of Nullsoft Winamp. Because of a failure to properly sanitize the length of a field containing a media file name, an attacker could entice a user to open a maliciously crafted M3U file, thereby allowing arbitrary code execution on the target system.

Extended Description

Winamp is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to crash the application, effectively denying service to legitimate users. An attacker may be able to exploit this issue to execute arbitrary code on the victim user's computer; this has not been confirmed. This issue is reported to affect version 5.13; other versions may also be vulnerable. This issue may be related to BID 9923 (NullSoft Winamp Malformed File Name Denial of Service Vulnerability).

Affected Products

Nullsoft winamp

References

BugTraq: 16623

CVE: CVE-2006-0708

URL: http://www.sans.org/newsletters/risk/display.php?v=5&i=7#widely4

Short Name

HTTP:STC:WINAMP:M3U-BOF

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Nullsoft Winamp M3U Remote Buffer Overflow

Extended Description

Affected Products

References

Found a potential security threat?