Winamp Skin Files Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1011071
|
|
SecurityTracker URL: http://securitytracker.com/id?1011071
|
|
CVE Reference: CAN-2004-0820
(Links to External Site)
|
|
OSVDB Reference: 9195
(Links to External Site)
|
Updated: Sep 2 2004
|
Original Entry Date: Aug 26 2004
|
Impact: Execution of arbitrary code via network, User access via network
|
Exploit Included: Yes
|
Version(s): 5.04 and prior versions
|
Description: A vulnerability was reported in Winamp in the processing of '.wsz' skin files. A remote user can execute arbitrary code on the target user's system.
K-Otik reported that a remote user can create a malicious skin file that, when loaded by the target user, will cause arbitrary code
to be executed on the target user's system. This can occur automatically without any user interaction.
The 'skin.xml' file within
the malicious '.wsz' skin file (zip archive) includes several files, one of which contains a 'browser' tag that loads HTML in the
Local Computer zone. The HTML, in turn, executes the arbitrary binary that is included with the '.wsz' skin file using an 'object'
tag with the 'codebase' attribute pointing to the binary.
This exploit is reportedly being used in the wild.
A demonstration
exploit is available at:
http://www.k-otik.com/exploits/08252004.skinhead.rar
|
Impact: A remote user can execute arbitrary code on the target user's system with the privileges of the target user.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.winamp.com/ (Links to External Site)
|
Cause: Access control error
|
Underlying OS: Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Aug 25, 2004
Subject: WinAmp
|
http://www.k-otik.com/exploits/08252004.skinhead.php
> Winamp <=5.04 Skin File (.wsz) Remote Code Execution Exploit
K-Otik posted an exploit for WinAmp, available at:
http://www.k-otik.com/exploits/08252004.skinhead.rar
The malicious skin file, when loaded by the target user, will cause arbitrary code to
be executed on the target user's system. This can occur automatically without any user
interaction.
The 'skin.xml' file contains includes several files, one of which contains a 'browser'
tag that loads HTML in the Local Computer zone. The HTML, in turn, executes the
arbitrary binary that is included with the '.wsz' skin file using an 'object' tag with
the 'codebase' attribute pointing to the binary.
|
|
