Dear bugtraq@xxxxxxxxxxxx, Can you, please explain why is this security bug? DoS is not software crash, DoS is Denial of Service. It means, security impact of DoS vulnerability should be preventing (blocking) access of legitimate user to some data or service (via data corruption, service malfuction, etc). In this case, user can be much easily abused in any media player by sending MP3 file with some very loud sound of finger by the wet glass or George Bush singing in the bathroom. --Tuesday, July 31, 2007, 1:38:41 PM, you wrote to bugtraq@xxxxxxxxxxxxxxxxx: bmo> -----BEGIN PGP SIGNED MESSAGE----- bmo> Hash: RIPEMD160 bmo> --------------------------------------------------- bmo> | BuHa Security-Advisory #15 | Jul 30th, 2007 | bmo> --------------------------------------------------- bmo> | Vendor | Nullsoft's Winamp (Lite) | bmo> | URL | http://www.winamp.com/ | bmo> | Version | <= 5.35 | bmo> | Risk | Low (Denial Of Service) | bmo> --------------------------------------------------- bmo> o Description: bmo> ============= bmo> Winamp is a proprietary media player for Windows systems. Visit bmo> http://www.winamp.com/ for detailed information. bmo> o Denial Of Service: bmo> =================== bmo> The M3U file format allows it to include local and remote files by bmo> simply specifing the path to the desired file. Furthermore Winamp does bmo> not check if the M3U file to include is the currently processed M3U bmo> file wherefore it's possible to force Winamp to recursively read a bmo> certain M3U file. Winamp allocates memory by each iteration which bmo> leads to a stack overflow exception (0xc00000fd). bmo> You are able to simply test this bug yourself by creating a file named bmo> 'a.m3u' with the content 'a.m3u'. If you are using the standard version bmo> of Winamp (not the Lite version) you just have to add the M3U file to bmo> Winamp by for example simply dragging the file into the playlist. bmo> The lite version catches the exception and exits if you add the bmo> malformed M3U file to the playlist. If you use the "Enqueue in Winamp" bmo> option (if configured you'll find it in the context menu) Winamp Lite bmo> does not catch the exception and crashes too. -- ~/ZARAZA http://securityvulns.com/
