Another hole in the once popular WinAmp has been discovered.
The latest breach, following separate discoveries in August and April, remains unpatched and could lead to an attacker accessing the system remotely and running code.
Brett Moore, of Security-Assessment.com, who discovered the flaw, writes that a boundary error in the ‘IN_CDDA.dll’ file could be exploited with a buffer overrun attack if a user was persuaded to visit a website containing a specially crafted ‘.m3u’ playlist. This would download and run automatically, without the victim having to explicitly click on anything on the malicious website.
Currently, security experts advise WinAmp users to disassociate files with .cda and .m3u extensions from the player.
Secunia has upgraded its severity rating for this flaw to Extremely Critical.
The flaw affects versions 5.05 and 5.06 of the player.
Disclaimer: Some pages on this site may include an affiliate link. This does not effect our editorial in any way.
