English
The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1

Winamp libsndfile.dll CAF Processing Integer Overflow Vulnerability


Secunia ID

SA33981

CVE-ID

CVE-2009-0186

Release Date

03 Mar 2009

Last Change

10 Mar 2009

Criticality

Highly Critical

Solution Status

Vendor Patch

Software

Winamp 5.x

Where

From remote

Impact
System access

This covers vulnerabilities where malicious people are able to gain system access and execute arbitrary code with the privileges of a local user.

Description

Secunia Research has discovered a vulnerability in Winamp, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to the use of vulnerable libsndfile code.

For more information:
SA33980

Successful exploitation may allow execution of arbitrary code.

The vulnerability is confirmed in versions 5.541 and 5.55. Prior versions may also be affected.

Solution

Update to version 5.551.
http://forums.winamp.com/showthread.php?threadid=303193

Reported by

Alin Rad Pop, Secunia Research

Original Advisory

http://secunia.com/secunia_research/2009-8/