Lucene search
HistoryAug 01, 2008 - 2:41 p.m.
CVE-2008-3441
cve-2008-3441
nullsoft winamp
update authenticity
arbitrary code execution
evilgrade
dns cache poisoning
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
7.5 High
AI Score
Confidence
High
0.005 Low
EPSS
Percentile
75.3%
Nullsoft Winamp before 5.24 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
Affected configurations
Node
nullsoftwinampRange<5.24
| CPE | Name | Operator | Version |
|---|---|---|---|
| nullsoft:winamp | nullsoft winamp | lt | 5.24 |
References
Related
cvelist
cvelist
CVE-2008-3441
2008-08-01 14:00:00
nvd
nvd
CVE-2008-3441
2008-08-01 14:41:00
prion
prion
Design/Logic Flaw
2008-08-01 14:41:00
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
7.5 High
AI Score
Confidence
High
0.005 Low
EPSS
Percentile
75.3%
Related for CVE-2008-3441