[ Illegal Instruction Security Research Labs Advisory ]
[--------------------------------------------------------------------]
Advisory name: CSS bug in Winamp
Advisory number: 8
Application: Winamp
Vendor: Nullsoft
WEB: www.winamp.com
Tested on: Winamp 2.76 and 2.79 (Windows 98)
Impact: CSS execution during generation of html playlist
Discovered by: DownBload
Mail me @: downbload@hotmail.com
------[ Overview
Winamp is (as we all know) the most popular mp3 player.
------[ Problem
ID3v2 tag in mp3 file contains some information about mp3 file (artist,
title, album, commet, etc.). Winamp supports creation of html playlist
from winamp playlist.
During generation process in html file is written only 'artist'
and 'title' section of ID3v2 tag.
In 'artist' and 'title' section, we can put arbitrary CSS code, which will
be executed when html playlist will be generated, and shown with default
web browser.
------[ Example
Open 'view file info' on some mp3 file (read only flag on that file must
be removed), and edit ID3v2 tag. Put some text in 'artist' section (if you
wanna fool somebody, it is the best to write the name of the artist and
song name in 'artist' section. After that put some blank space characters
(around 100) and . after that), and CSS code which will be executed
in 'title' section. For testing purpose, in 'title' section, you can put:
-----cut here-----
<script> alert ("HI!!!"); </script>
-----cut here-----
You can put some blank space (in 'title' section) before CSS code too.
After that generate html file from playlist, and you will see msgbox, with
text HI!!!
------[ GREETZ
Goes to Illegal Instruction Labs (Boyscout, h4z4rd, Sunnis, Styx),
www.active-security.org, finis, Fr1c, harlequin, st0rm, phreax, all of
#hr.hackers <irc.carnet.hr>.
Thanks to dr_cr@zy for providing me with hardware support, when my computer
is on vacation :).
Very special greetz go to |<4r0l1n4.
I'm very sorry if I forgot someone...
