Winamp 0-day exploit

Pankaj

Oct 26, 2010 • 1 min read

BitDefender labs, creator of security software, identified four critical vulnerabilities affecting Winamp 5.x on 15th of October. Shortly thereafter, several exploits piggybacking on these vulnerabilities were spotted in the wild. The first three basically didn’t need any user interaction beyond loading them into the playlist. The “weapon” used by the cyber-criminals is a malformed MTM file – an audio file format similar to the MOD and MIDI file – distributed to different potential victims as e-mail attachments, or through social networking or peer-to-peer file sharing. Its purpose is to lure computer users into downloading and adding it to their playlist.

The act of user viewing the file info in Winamp sets the exploit contained inside the malformed MTM file into motion. As soon as the user views the file information, the exploit will initialize a backdoor service running on port 4444 and it will be ready to take connections from the outer world. The backdoor will be consequently used by an ill-intentioned person to easily gain remote access to your computer with the same privileges as the user running Winamp.

BitDefender detects the malformed file as Exploit.Winamp.D and will terminate it before the user is able to load it in the player. In order to stay safe from this type of exploits, the users are advised to download files from trustworthy repositories only and never perform any actions on the computer if they have been requested or suggested by persons you do not know or trust.