Brown Thoughts

Danish vulnerability tracker Secunia and eEye Digital Security of California have discovered a flaw in the Winamp 5.34 plugin that decodes MP4 files. It seems that an attacker could compromise a computer by feeding a specially made MP4 file to the player. This would allow the attacker to execute malicious code remotely. According to eEye’s alert:

“A media player remote code execution vulnerability has a very high impact since the source of the malicious payload can be any site on the Internet. An even more critical problem is generated when clients are administrators on their local hosts, which would run the malicious payload with administrator credentials.”

While we wait for a patch from Nullsoft, a simple way to prevent this is to disassociate the .mp4 extension from Winamp by going to Options -> Preferences, then General Preferences -> File Types and deselecting MP4.

Technorati Tags: Winamp 5.34, Security Holes

(No Ratings Yet)

 Loading ...

• Liked this post? Subscribe to the RSS Feed