Serious security flaw in WinAmp

A serious security flaw in NullSoft’s popular WinAmp player opens the door for crackers to seize control of vulnerable systems.

The problem stems from a flaw in how the player processes Winamp skin zip files. This flaw means WinAmp users induced to visit a maliciously constructed website could find their PCs rooted. The vulnerability has been confirmed on a fully patched system with WinAmp 5.04 using Internet Explorer 6.0 on Microsoft Windows XP SP1. WinAmp 3.x users are also potentially in peril. And that’s not the worst of it. The bug, reported by the K-OTik.COM Security Survey Team, is reportedly being actively exploited in the wild.

NullSoft is yet to release a patch. Security firm Secunia describes the flaw as “extremely critical”. Pending the availability of a fix, Secunia advises WinAmp users to use an alternative product.

Visit here to see the Secunia Advisory.

News source: TheRegister

LEAVE A REPLY

Please enter your comment!
Please enter your name here