Winamp 5.12 - 0day exploit - code execution through playlist

[Process]

The current version of winamp contains an error in its playlist parsing allowing malicious users to
execute code via a prepared playlist.

This bug can even be triggered through a website - without user interaction - by linking to a pls
file in an IFRAME tag.

Windows DEP (Data Execution Prevention) will stop this bug. If you dont have DEP its strongly
advised to delete Winamp until a non vulnerable version is released.

More information (in german, babelfish is your friend :) at http://www.heise.de/newsticker/meldung/68981


Greets,
carol

<a href="http://www.tarifchecks.de/">http://www.tarifchecks.de/</a>
<a href="http://autoversicherung.einsurance.de/">http://autoversicherung.einsurance.de/</a>

[Chris Wysopal]

You can disable auto launching Winamp for playlist files as a workaround.

For Firefox, go to Tools / Options settings, click on Download icon, then
click on View & Edit Actions... Scroll down to M3U extension and then
push the Remove Action button. Firefox will no longer automatically
launch firefox for Winamp playlist files.

It is a good idea in general for attack surface reduction to trim down the
View & Edit actions to just the ones you need. Do you really need AIFF and
AU autolaunching for instance? What about all those Quicktime and Acrobat
formats? Looks like a lot of unnecessary attack surface to me.

For IE you need to disable the file type in Windows Explorer. Go to Tools
/ Folder Options / File Types. Scroll down to the file extension you want
to change. In this case its M3U. Check Confirm after download. You will
be prompted to launch WinAmp if a M3U file is downloaded. You can remove
the file type completely but that will also remove the ability to
double-click to launch playlists from the Windows shell.

You may want to go through this list and check confirm after download for
many file types. It would be nice if more vendors installed their file
types with this option in place.

-Chris

[bart sikkes]

> You can disable auto launching Winamp for playlist files as a workaround.

sans claimed that certain workarounds weren't full proof either.
anyway winamp released version 5.13 that should fix this, that seems
the best thing to do.

bart