Signature Detail

APP: Nullsoft Winamp AVI Stream Count Integer Overflow

This signature detects attempts to exploit a known vulnerability against Nullsoft Winamp. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the affected application.

Extended Description

Winamp is prone to multiple integer-overflow vulnerabilities because the application fails to perform adequate boundary checks on user-supplied input. Attackers may leverage these issues to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

Affected Products

• Nullsoft winamp 5.0.0 1
• Nullsoft winamp 5.0.0 2
• Nullsoft winamp 5.0.0 3
• Nullsoft winamp 5.0.0 3A
• Nullsoft winamp 5.0.0 4
• Nullsoft winamp 5.0.0 5
• Nullsoft winamp 5.0.0 6
• Nullsoft winamp 5.0.0 7
• Nullsoft winamp 5.0.0 8
• Nullsoft winamp 5.0.0 8C
• Nullsoft winamp 5.0.0 9
• Nullsoft winamp 5.0.0 91
• Nullsoft winamp 5.094
• Nullsoft winamp 5.11
• Nullsoft winamp 5.12
• Nullsoft winamp 5.13
• Nullsoft winamp 5.2
• Nullsoft winamp 5.21
• Nullsoft winamp 5.22
• Nullsoft winamp 5.24
• Nullsoft winamp 5.3
• Nullsoft winamp 5.31
• Nullsoft winamp 5.3.2
• Nullsoft winamp 5.33
• Nullsoft winamp 5.34
• Nullsoft winamp 5.34A
• Nullsoft winamp 5.35
• Nullsoft winamp 5.5
• Nullsoft winamp 5.51
• Nullsoft winamp 5.52
• Nullsoft winamp 5.54
• Nullsoft winamp 5.541
• Nullsoft winamp 5.55
• Nullsoft winamp 5.552
• Nullsoft winamp 5.56
• Nullsoft winamp 5.6
• Nullsoft winamp 5.601
• Nullsoft winamp 5.61
• Nullsoft winamp 5.6.1
• Nullsoft winamp 5.621
• Nullsoft winamp 5.622

References

• BugTraq: 51015
• CVE: CVE-2011-3834
• URL: http://forums.winamp.com/showthread.php?t=332010