CVE-2004-1150 Stack-based buffer overflow in the in_cdda.dll plugin for Winamp 5.0 through 5.08c allows attackers to execute arbitrary code via a cda:// URL with a long (1) device name or (2) sound track number, as...
MediumCVSS 5.1
EPSS 8.7%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Stack-based buffer overflow in the in_cdda.dll plugin for Winamp 5.0 through 5.08c allows attackers to execute arbitrary code via a cda:// URL with a long (1) device name or (2) sound track number, as demonstrated with a .m3u or .pls playlist file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nullsoft winamp | = 5.0 | No fix listed |
| nullsoft winamp | = 5.01 | No fix listed |
| nullsoft winamp | = 5.02 | No fix listed |
| nullsoft winamp | = 5.03 | No fix listed |
| nullsoft winamp | = 5.04 | No fix listed |
| nullsoft winamp | = 5.05 | No fix listed |
| nullsoft winamp | = 5.06 | No fix listed |
| nullsoft winamp | = 5.07 | No fix listed |
| nullsoft winamp | = 5.08c | No fix listed |
References
- 20050127 NSFOCUS SA2005-01 : Buffer Overflow in WinAMP in_cdda.dll CDA Device Name mailing-list
- 13781 third-party-advisory
- www.nsfocus.com exploit
- 12381 vdb-entry
- www.winamp.com
- winamp-incdda-bo(18840) vdb-entry