QUOTE
Winamp is vulnerable to a buffer overflow vulnerability when processing ID3v2 tags of mp3 files. To exploit this vulnerability, a user has to add malformed mp3 file to the Winamp playlist, and play it.
When playing mp3 file is finished, playlist is updated, and if some part of the ID3v2 tag (e.g. ARTIST or TITLE) is too long, it is possible to overflow value that is later used as the source address in the strcpy() function. The strcpy() call can overflow a value (in the DATA segment) that will later, in jump instruction, point code execution to some attacker-supplied buffer, where malicious code can be executed.
When playing mp3 file is finished, playlist is updated, and if some part of the ID3v2 tag (e.g. ARTIST or TITLE) is too long, it is possible to overflow value that is later used as the source address in the strcpy() function. The strcpy() call can overflow a value (in the DATA segment) that will later, in jump instruction, point code execution to some attacker-supplied buffer, where malicious code can be executed.
Looking into it more atm - hopefully will be able to decode the provided PoC to give more detailed information on the exploit and where they went wrong - untill then their website gives alot of great information, more than a typical security advisory would
Credits for this vulnerability goes to Leon Juranic ljuranic@lss.hr.
hxxp://security.lss.hr/en/index.php?page=details&ID=LSS-2005-07-14
(its not a fake link though
)
