--- DownBload <downbload@hotmail.com> wrote:
>
>
> [ Illegal Instruction Security Research Labs
> Advisory ]
>
[--------------------------------------------------------------------]
> Advisory name: CSS bug in Winamp
> Advisory number: 8
> Application: Winamp
> Vendor: Nullsoft
> WEB: www.winamp.com
> Tested on: Winamp 2.76 and 2.79 (Windows 98)
> Impact: CSS execution during generation of html
> playlist
> Discovered by: DownBload
> Mail me @: downbload@hotmail.com
>
>
>
>
> ------[ Overview
> Winamp is (as we all know) the most popular mp3
> player.
>
>
>
>
> ------[ Problem
> ID3v2 tag in mp3 file contains some information
> about mp3 file (artist,
> title, album, commet, etc.). Winamp supports
> creation of html playlist
> from winamp playlist.
> During generation process in html file is written
> only 'artist'
> and 'title' section of ID3v2 tag.
> In 'artist' and 'title' section, we can put
> arbitrary CSS code, which will
> be executed when html playlist will be generated,
> and shown with default
> web browser.
>
>
>
>
> ------[ Example
> Open 'view file info' on some mp3 file (read only
> flag on that file must
> be removed), and edit ID3v2 tag. Put some text in
> 'artist' section (if you
> wanna fool somebody, it is the best to write the
> name of the artist and
> song name in 'artist' section. After that put some
> blank space characters
> (around 100) and . after that), and CSS code which
> will be executed
> in 'title' section. For testing purpose, in 'title'
> section, you can put:
> -----cut here-----
> <script> alert ("HI!!!"); </script>
> -----cut here-----
> You can put some blank space (in 'title' section)
> before CSS code too.
> After that generate html file from playlist, and you
> will see msgbox, with
> text HI!!!
>
>
>
> ------[ GREETZ
> Goes to Illegal Instruction Labs (Boyscout, h4z4rd,
> Sunnis, Styx),
> www.active-security.org, finis, Fr1c, harlequin,
> st0rm, phreax, all of
> #hr.hackers <irc.carnet.hr>.
> Thanks to dr_cr@zy for providing me with hardware
> support, when my computer
> is on vacation :).
> Very special greetz go to |<4r0l1n4.
> I'm very sorry if I forgot someone...
This appears to be corrected in Winamp 2.80, as i was
unable to get the exploit functional.
- Chris (chris@box.sk)
http://linux.box.sk/
http://blacksun.box.sk/
__________________________________________________
Do You Yahoo!?
HotJobs - Search Thousands of New Jobs
http://www.hotjobs.com
