ALARM Group ALERT - click for a description of ALARM, The Computing Alert System Alert Number:  050207-03 Alert Date:  05/02/07 Alert Title:  *Zero-day exploit for Winamp Update-to:   None OS/Platform/Application:  Winamp v5.x on (potentially) all systems Category:  ALERT Severity: MEDIUM Attention:  System Administrators/Users, Desktop Support Personnel, Winamp users

Summary:  Multiple Internet security-related agencies are reporting the existence of a vulnerability in AOL Music's popular WinAmp media player.  The vulnerability is related to the handing of MP4 files and can result in remote code execution/system takeover.  The most likely vector of exploit is the opening of a specifically-crafted MP4 message.  At the time of this writing (4:45 EST on 5/2/07) a patch has not been provided by the vendor.

Recommended Actions:  Although a patch is not yet available numerous workarounds have been suggested by various security agencies and resources.  Support personnel and WinAmp users are encouraged to read the information on this vulnerability (links provided below) and (if appropriate) consider the implementation of one or several of the suggested countermeasures.

ITS Actions:  N/A

Resources:

Secunia Advisory:
http://secunia.com/advisories/25089/

Eeye Advisory (includes steps to dissociate handing of MP4 files):
http://research.eeye.com/html/alerts/zeroday/20070430.html