Winamp 5.5.8.2985 – Multiple Buffer Overflows
Source: http://aluigi.org/adv/winamp_1-adv.txt ####################################################################### Luigi Auriemma Application: Winamp http://www.winamp.com Versions: <= 5.5.8.2985 (aka v5.581) Platforms: Windows Bugs: A] integer overflow in in_mkv B] integer overflow in in_nsv C] integer overflow in in_midi D] buffer-overflow in in_mod Exploitation: remote, versus server Date: 13 Oct 2010 Author: Luigi Auriemma e-mail: aluigi@autistici.org web: aluigi.org ####################################################################### 1) Introduction 2) Bugs 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== Winamp is one of the most diffused and appreciated media players for Windows. ####################################################################### ======= 2) Bugs ======= ----------------------------- A] integer overflow in in_mkv ----------------------------- The in_mkv plugin uses a particular function (address 077078c0) for reading text strings from the Matroska containers. The operations performed are the reading of the ebml numeric value (64bit), the allocation of memory corresponding to that value (32bit) plus 1 and the subsequent reading of the data from the file leading to possible code execution: buff = malloc(size + 1); if(buff) fread(buff, 1, size, fd); ----------------------------- B] integer overflow in in_nsv ----------------------------- The in_nsv plugin is affected by an heap-overflow caused by the function (address 077ca422) that first verifies the size of the metadata string contained in the file adding 1 to it and then copies 0x1fffffff bytes in a heap buffer leading to possible code execution (077C8577 CALL DWORD PTR DS:[EAX+8]): memcpy(heap_buffer, attacker_data, size >> 3); ------------------------------ C] integer overflow in in_midi ------------------------------ The in_midi plugin is affected by an heap overflow during the handling of the hmp files (a format used in some old DOS games) where a variable-length 32bit value is used for the copying of data with memcpy() from the attacker's data to a heap buffer which has not been reallocated for matching the needed size due to an integer overflow. Doesn't seem possible to control the code execution. ---------------------------- D] buffer-overflow in in_mod ---------------------------- The in_mod plugin is affected by a stack overflow which happens during the handling of a malformed MTM file but it's required that the user manually clicks on the player for visualizing the detailed informations of the track. ####################################################################### =========== 3) The Code =========== http://aluigi.org/poc/winamp_1.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15248.zip (winamp_1_13Oct10.zip) ####################################################################### ====== 4) Fix ====== No fix. ####################################################################### |