Slashdot Mirror
WinAmp Security Hole Discovered, Patched
Sbarbero writes "According to Techworld.com, a significant security hole has been discovered in NullSoft's WinAmp, meaning everyone should upgrade to the 5.03 version the makers have just put out right now. Security company NGS has found that the exploit 'can be activated remotely simply by rendering a specially crafted html document' and will run arbitrary code - they have a full advisory on their site." Oddly enough, the vulnerability is in the playback for the classic .XM 'tracker' music format.
See, it pays to be a cyber-luddite. I'm still using version 2.91
"activated remotely simply by rendering a specially crafted html document" Wouldn't that only make it a problem for those people who actually use the Winamp minibrowser? (I.E., very few people?)
I see nullsoft have also used this opportunity to force all us old Winamp 2.9 users to upgrade to the bloated POS Winamp 5 player.
Some of us just want an MP3 player - we don't need cpu-hogging visualisations, 100s of "cool" skins, or any of the rest of it.
Time to give some of the other players a try, methinks...
</rant>
Hi from Napster! We've been tracking your listening habits and suggest the following music...Barry Manilow, Air Supply, Leo Sayer. If you act now and buy, we won't tell your friends or neighbors.
A feeling of having made the same mistake before: Deja Foobar
whether this affects the old 2.x series?
I am so tired of waiting.
I'm still using version 1.45. Free of the spyware and bloat which has come to plague Winamp, and I'm pretty sure it is free of the trojan-type "features" that this story is about.
Don't blame Durga. I voted for Centauri.
if you see a version and date matching 'v5.02 (x86) - Feb 4 2004' or older, it is highly recommended that you update as soon as possible.
Guess this means I need to mass e-mail friends and family still using Kazaa and Kazaa-like tools for filesharing. I know that newer versions of Kazaa come with some sort of file scanning tool, anyone know if that picks this sort of stuff up? (or will after the definitions are updated)
-Adam C. Greenfield
You can always upgrade to http://www.foobar2000.org/ instead. No more nonstandard interface, a decent mass-tagger, excellent replay-gain support, etc. What's not to like?
Belief is the currency of delusion.
I've never used a Fastrack XM file in my life. Is this a widely used format?
- Jax
Is WinAmp the free multimedia player of choice for Windows users? I know we've always talked about how Windows Media Player is eeeevil and RealPlayer is spyware. Where does WinAmp kick in? Does it do video or is it just a music thing? (like a free alternative to MusicMatch Jukebox or whatnot) It has been ages since I've follwed up (as a Linuxer I go between noatun and xmms)
Basically, I guess the question is how to make a strong case for WinAmp use. I already sing the praises of Firefox and recommend OpenOffice to folks who don't want/can't shell out $$ for MS Office. I recommend AVG as a free virus-scanner. Same with ZoneAlarm, Spybot S&D, and Ad-Aware. What winning argument do I use to say "use WinAmp instead of..." to Windows users who ask?
I can't believe people are actually complaining about winamp bloat. Winamp has been one of the better examples of not-bloat. Sure, 5 is worse than 2, but it's better than 3, and much of the CPU-hogging goes away when you go back to classic skins. For me, the enqueue function makes it well worth it.
I think the only way you can get less bloated is if you used something like mpg123. XMMS is a winamp-clone on linux anyway.
winamp3 was the bloated piece of crap. winamp5 is not a bloated piece of crap. they dropped wasabi. please check your facts before making posts.
I'm sure the millions of people who use Winamp as their main browser will not like this at all.
And since winamp uses IE for web page rendering people are used to so high standards for security.
bummer.
I used to track mods on the Amiga (protracker) and PC (Fast Tracker2). It was a fairly common occurence for people to load text/image files into songs as a playable instrument within a music module. You could then transfer the module (which contains both the instrument samples & the pointers to the coded music (it's all addressed through HEX!)) and then extract the datafile (save instrument as...) then view it in your favorite image viewer or text editor....
FYI:
Data files as instruments do not really sound as cool as you'd think though. If the file has header info, that's where you'd find the most variety and interesting sounds...
it's not the huge bloated mess that winamp3, was it's still not lightweight. on slower machines there's still a noticeable difference between 2 and 5.
If I remember, Winamp uses a modified version of Mikmod, a well known module player, which is also available in some Linux distro.
Will this bug be updated in mikmod as well ?
I hope that one day, Winamp will drop Mikamp and use Modplug instead, which sources has been released and it the best player on Win32 (mikmod sounds horrible on Windows, and is buggy).
Also modplug plays more formats and is better, although is win32 only;
I need a Sino-Logic 16. Sogo-7 data-gloves, a GPL stealth module...
you go with your badself
Since version 2, Winamp has been notorious for playing MOD, XM, S3M, and related files inaccurately. It fudges up a lot of the effects, particularly portamento (note slide) and key-off commands. You all should be using ModPlug Player to play these formats! It ain't perfect but it's the best Windows player there is.
Why get this player? So that you can drink deeply from the cup of BBS\Internet history! Check out some MOD sites and dig some chippy goodness!
SHAMELESS PLUG -- Be sure to scope out my MODs as well!
Here's an idea to keep yourself free from these type of third party software security issues.
.XM files?) So, go to command prompt (or your favourite association editor) and type ASSOC and change the association of .XM files.. Pretty simple.. In fact, change all associations except .WAV, .MP3 and .MPEG (or whatever video/audio formats you prefer), that deal with Winamp.
Don't have it automatically load at boot. Simple! Next, change your association's to only load the files you want (for example, I don't know _anyone_ that uses Winamp for more then video playing and mp3's, what's with the
Another way to change file associations is to go into Explorer, "Tools" pull down menu, select "Folder Options", click the tab "File Types" and you can delete them from here.
Now this solves the loading problem, if it loads only when you click on your MP3 you don't have to worry about it leaving open ports (this goes for any third party software you don't need running all the time..). Not only will this prevent this sort of attack, but you'll get some freed resources, and a faster boot time, 'to boot'!..
Mod +5 Drunk
winamp 5 rocks! it has a built in crossfader and the download (just dl it) was 680k. install size 1.5 mb. i would LOVE to see any other program i use as much (possibly notepad) match that!
ITS NOT WINAMP 3 which was the winME of software amps
If for some reason it is impossible to download the updated version of
Winamp, the vendor has informed NGSS that it is possible to disable the
handling of Fasttracker 2 module files by taking the following steps:
1. Right click the Winamp player, go to 'Options' and then to
'Preferences...'.
2. In the new window which loads, go to 'Plug-ins' and 'Input'.
3. Look for the input plug-in items 'Nullsoft Module Decoder' and double
click it to bring up the 'Nullsoft Module Decoder Preferences' window.
4. Select the 'Fasttracker 2' loader and deselect the 'Enabled' checkbox to
the right of the loaders list.
5. Close all of the option windows and return to the main player.
no he doesnt, mod parents down
Crap like this is why you should never use third party software like Winamp. Stick with Microsofts line of quality products and you'll be safe.
Seriously, just look at the time it took to fix this bug. I could almost read the entire headline before the fix. The bug took as long to fix as to read the comma between "Discovered" and "Patched". I expect better from Third Party software.
Until Third Party software is able to show they care about their products I can only recommend that you stick with 100% Microsoft Approved Solutions.
I don't need no stinkin' sig!
I don't know why I'm replying to your flamebait but the last time I checked WMP didn't cost anything either.
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.
lies! mod them all up! UP I SAY!
Just do a minimal install of 5.03 (without letting it integrate into the shell, etc) and copy the new in_mod.dll from /winamp5dir/plugins to /winamp2.91/plugins..
While you're at it; all the new and updated input plugins (in_mp3, in_midi, etc) seem to work just fine in 2.91.
No, seriously folks.
Under Windows 3.1.
You can download your very own copy right here!
is to use Startup Control Panel
The core Foobar2000 is quite slim and....
you can choose to download and install the open source components (official or third parties) that you want....
this is customization as it should be.
last time I checked WMP didn't cost anything either.
Any program distributed only with Microsoft Windows costs 150 USD or so for a Windows XP Pro OEM license. So does any Win32 program designed to bail if it detects Wine.
To fix your version of WinAmp that isn't in the v5.0 tree, download a copy of WinAmp v5.0.3 and install it. Rip the in_mod.dll out of the plugins directory, and transplant it into your WinAmp v2.x plugins directory.
:).
This method is of course untested, so if anything goes wrong, just throw your computer out
they dropped wasabi.
Really?
Going from the link to Wasabi that you provided, I stumbled upon their license page, which specifically says that Winamp 5 uses Wasabi:
"Wasabi is not totally open-source: the core skinning and Maki scripting framework (wasabi.dll) is still closed-source, as it is used in Nullsoft's flagship product Winamp 5."
Obviously, I could just be missing something. But it sure seems like Wasabi is indeed used in Winamp 5.
Perl - $Just @when->$you ${thought} s/yn/tax/ &couldn\'t %get $worse;
thats a real shame. despite nullsofts claims, i still far prefer winamp 2.x, it is simplier to use and is alot smaller. even worse, xm is one of my favorite formats. it is to a midi like a shell script is to a batch file
Systems Affected: Nullsoft Winamp versions 2.91 to 5.02 (possibly older versions, although this is not confirmed)
You just MIGHT want to upgrade...
Is it really overrated to prefer to play MP3's with a program (Winamp 1.45) which plays MP3's very well?
At a mere 400K, it loads and runs a lot faster than the alternatives from Winamp (and Real, Media Player, etc) and it is not ruined by being fitted with browsers, spyware, or other bloat.
It plays MP3s and it does it perfectly. But yes, I admit, I can't check www.slashdot.org with it because there is no browser in this MP3 player. Nor can I generate Quake levels, burn AVI files to DVD, or create amazing fractal background wallpaper.
Don't blame Durga. I voted for Centauri.
I don't know about you but I do not find it very surprising when I hear that Windows or a Windows software suffer from a vunerability. It is so common by now that it's like saying unions encourage lazyness, as much as we know about it people don't care they consider it normal because it too much of a fact and nobody truly does something about it. They feel powerless.
Hearing that a similar vunerability has been found on Linux or the Mac would surprise me a lot, not because they are immune to it but more because of the rarity of such an announcement, imagine my surprise when I read a few month ago that a vunerability was found in Open BSD, many were talking about it, but Windows...
Thats actually the evil of it, there are so much holes in that system and its related software that its even getting annoying to hear about it...
And disinterest is the best weapon Microsoft could ever get...
Now is a good time to do that, if you're already going through the trouble of a download and a re-install.
The subtle irony of your post should rank at least a "Funny" mod or two. You were trying to be dryly ironic, right?
Viv
Gmail invites for ip
I just installed 5.03 and got a treat! Claria's GAIM/GMT/Gator. Mmmm. Spyware.
Does Winamp use IE to render web pages, or is it their own broswer? If it is actully using IE then I definitly don't want it to load due to IE's security flaws.
And is there any way to prevent the broswer from loading? Or is there a shoutcast like page listing TV stations? I am sick of online radio/tv stations, skins, etc loading web pages in this browser, and would like to just use a plain web broswer to find radio/tv staions.
This quality karma whoring brought to you by toqerTV
Hot off #nullsoft
i don't even think the exploit is in our code
ron, is the exploit in the decoder?
isn't it in mikmod
When is the Mac version of this exploit coming out?
I am so tired of waiting.
hehe
i don't think we even wrote that xm decoder
*** Quit: statsbot (Ping timeout: 180 seconds)
*** Join: DrunkenMaster (DM@adsl-66-159-200-78.dslextreme.com)
`steev: the exploit was in the mikmod library that's used by in_mod for xm decoding
so its not even our code heh
yeah
there you go
it's not even our fault the exploit exists
So this isn't even a winamp bug, it's a mikmod bug.
It's because Microsoft doesn't release patches for known exploits for a very long time, (Internet explorer), and generally gives the impression of not really caring about its users.
Also, WinAmp isn't exaclty an operating system, now is it?
Because of the type of files affected by this bug, this thread may be the most appropriate to ask it: being that FastTracker 2 is a bit outdated, what tracker software are people currently using?
I'm no music composer, so expensive packages are but. I just want something to have some fun in the spare time, kinda like FT2, just a bit easier on newer hardware and (Gor forgive-me) that runs under Windows.
Thanks!
I agree that ModPlug should be used. I use its player for MOD, S3M, XM, 669, etc. weekly. In fact, I am using it right now to listen to a MOD song. It is a great Windows player for headphones and nice speaker setup!
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
No it isn't. Normal practice is to mod you up to 5 (especially if you claim you'll be modded down). I don't know if it was intentional in your case, but it's oldest karma whore tactic in the book.
Anyway, I for one have long given up criticizing the slashdot editors. They just don't care.
Though I recently converted much of my mod/XM/s3m/IT collection to mp3 format, since it will play in my car/portables that way.
I haven't *downloaded* any of those files in ages though. Anyone know where one can find good ones?
I see.
try this:
http://www.oldversion.com/program.php?n=winamp
Don't blame Durga. I voted for Centauri.
ALL PHEAR THE FRANKEL!!!
Step 1: Create a program everyone uses with a security flaw.
Step 2: Leave the company you made it with.
Step 3: TAKE OVER THE WORLD!
Does anybody use this anymore? itunes and wma player are pretty good at what they do. winamp is a relic of the past, folk need to move on to something more modern.
Activists United
FreeAmp, now called Zinf, can be downloaded here. Free, open source, runs on Linux and Windows. No advertising. Just plays.
I use the "XM tracker format" "all the time"...
I'm so scared...
Some of this "vulnerability" stuff is getting out of hand.
Reminds me of the Marty Feldman bit where he goes into an insurance broker's office and asks him if he is protected "from falling into a pit of hedge-hogs whilst playing croquet" and "from being struck by a meteorite whilst sun-bathing on the beach?"
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
I use Winamp 5 because is has global shortcuts. No matter what application I am in, I can hit the key combo and turn up the volume. That's great functionality that I haven't seen elsewhere.
A NYC lawyer blogs. http://www.chuangblog.com/
http://download.nullsoft.com/winamp/client/winamp2 81_full.exe
At least they still host it. (you can also s/full/lite in the URL)
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
Who said XM is a classic format?
.mod file then it ain't worthy of the name Tracker!
Bah!
If it's ain't an original
(Spudley Strikes Again!)
Liked Jaunt? Check out some of his other music here. (He's changed his name since he wrote that piece.)
Winamp 5 is merely a continuation of the Winamp 2 codebase, but with the skinning capabilities of Winamp 3.
3 + 2 = version 5. For me, Winamp 5 works like 2 always did. 3 was so slow.
They simple re-released this fixed version that plugs the security hole.
This has to be one of the most flagrant trolls I've seen in a while.
LinunxSecurity lists weekly security advisories for all the distros--buffer overflows, exploits, and all around security flaws that never get reported around these parts.
Hope that doesn't "surprise" you since it's not Windows software. Yes, believe it or not, OSS software is not somehow magically perfect simply because it's compiled for Linux via gcc rather than for Windows via Visual Studio...programmers are programmers.
Does this also affect my current version of XMMS?!
Oh wait, wrong OS. Never mind.
the vast majority of home desktop PC users already have copies of Windows installed that were either free or included in the cost of something else.
I've seen x86 PCs at a Wal-Mart brick and mortar store in Fort Wayne, Indiana, for $600 including display. Take away Wal-Mart's markup, and how much of what's left is the OS license? As the price of x86 PC hardware falls, the Windows license constitutes a growing fraction of the cost of goods sold, prompting some x86 PC manufacturers to sign deals with distributors of operating systems based on a BSD or Linux kernel.
And no, I guess you don't have to have an x86 PC to run the backend of Windows Media Player, as many dedicated media device manufacturers have begun to include WMA and even WMV support.
-1!!! aahhh come on, I'm really trying my best to be funny ;-)
itunes is far superior and compared to that last release of winamp, it is very light on resources. I stopped with winamp the day they stopped ver 2.x
The war with islam is a war on the beast
The war on terror is a war for peace
Hi, I'm an ex-Fast Tracker 2 guy. I haven't used Buzz or Renoise, but I just moved on to Skale:
http://www.skale.org.
It looks just like Fast Tracker 2, runs under linux or windows xp, it's free, and they're incorporating VST/ASIO support into it as well. I think I've settled on using this.
But good thread, I'm going to go check out the others myself now. It's been a couple years since I wrote a new tracker song, need to get busy again, I really miss it.
did you RTFA[dvisory]?
I remember when legal used to mean lawful, now it means some kind of loophole. - Leo Kessler
Really? I have winamp503_full.exe in my downloads folder with a date of 3/25/04. Is this the same as the "new and improved" v503?????
By this logic then Winamp costs $150.
I'd think that Winamp would work better in Wine han Windows Media Player would. (researches) My hunch was correct. According to this page, you can run at least one version of Winamp in Wine provided that you have installed a native msvcrt.dll from sources such as Adobe Acrobat Reader 5.
Here's the HTTP headers to the current winamp:Here's the md5sum:
"...our analysis finds that the changing rate or the functions modified as a percentage of the total functions is higher in open-source projects than in closed-source projects. This supports the hypothesis that defects may be found and fixed more quickly in open-source projects than in closed-source projects and may be an added benefit for using the open-source development model."
Take that, you Microsoft shills!
This new version crashes hard (drwatson) after adding songs from a directory and then trying to play them in WinAmp.
Vulnerablity or not, I'm going back to the old version.
Dolemite
__________________________
Save the World! Use a Quote!
Well, if size is a problem, how about XMplay?
Its a tiny exicutable file, and it even has a winamp skin if you like that look. Plays pretty much any music media type. I use it, though I have to admit that it doesn't enhance the sound quality like Media Jukebox or anything, though I do enjoy the custom keyboard hotkeys that work even if it isn't the active application. alt-space = pause/play. woo.
XMplay
And not really caring for it much... it doesn't seem to work easy in terms of the playlist and whatnot. Doesn't auto-scroll if you're trying to move a file from the bottom to the top.
No volume control either.
This is actually a serious issue, even if you don't run into .XM files.
.DOC files around. Macro viruses picked up. With the Internet, worms are becoming more of an issue.
Viruses and malware have adapted to fit the times. At one point, they spread on disk boot blocks, when floppies moved around, and via executables. Then people started using hard drives and stopped swapping things around as much, but starting tossing
Now that people swap files around via P2P and other systems, there must be consideration given to insufficiently robust file I/O code. When I'm writing a network-using application, I'm darn careful to validate that all the data coming in is correct. There's a much stronger temptation to assume that data is valid when reading in a data file, or to not check for every possible type of inconsistent data. As a result, there are probably many, many buffer overflows that can be exploited by opening documents in programs -- a program reading in a document should treat that document as if it is written by a hostile intruder.
Besides, isn't it better to be safe than sorry? I've known some holes that *seemed* obscure, but if people ignored them, they could have become very nasty.
May we never see th
XMMS is commonly distributed (for example, by Red Hat) using mikmod as the default mod playing library, so it is probably vulnerable as well.
It's easy to disable Mikmod support in your Preferences-<Input Plugins list.
I would, in any event, suggest using the xmms Modplug plugin rather than the mikmod plugin to play xm/s3m/it/mod/etc-- it provides more features and (optionally) better audio quality.
May we never see th
CD music takes up a lot of space, MP3s take up a bit of CPU but are much more space-friendly.
However...
mod files (with mp3s or whatever as their 'sample' source) have some advantages.
For example, you can speed up or slow down the the playback without pitch change in virtual perfection. With an MP3 this is difficult to do on-the-fly and usually ends up sounding crappy.
Conversely, you can change the pitch without changing the speed.
Files are even smaller than MP3s. You could easily fit a 30-minute soundtrack in less than 250KB.
This is less of an argument, considering an mp3 is plentifully small for a CD distribution, but when doing things for e.g. GBA SP or ringtones that don't sound like very lame AdLib midis, this does become an issue.
There's other advantages, but those don't fare as well when compared to just using an mp3.
I'm going to get modded OT for this, but don't want to post AC. Kudos to you for posting a response to this FUD, and promptly at that. Too often people from the dev teams sit back as the idiots on here flame their products. Winamp is an excellent product, and I've been using it since 1.xx. I even tried 3 (shudder ;). Keep up the good work, guys.
;)
P.S. More kudos for removing AOD
Ha, that's the best versioning logic. I've long waited for someone to adopt Fibonacci numbers for versioning their software. ...
2+3=5
3+5=8 - the next version
I already see it now, year 2012, winamp reaches its version 610, featuring new codec system from 377 and gui3D framework from version 233 (for the mathematically challanged: 377+233=610).
This is sorta offtopic but is there a way use Lame inside Winamp 5 to encode your music instead of the bundled mp3 encoder licensed off Mp3Dev?
If you're really that concerned/paranoid about XMMS' MikMod features being similarly taken advantage of, you could always disable the plugin in XMMS' Preferences. Click on the plugin, uncheck 'Enable Plugin'.
But on old Cyrix-based PCs (i.e. no MMX/SSE) it's noticeably slower than WinAmp 2.91 Which is why so many people here are still running WinAmp 2.x - it's small and fast. AC
there is a v5.03a that was released last tuesday last week. the only difference should be a bug that was fixed with the repeat all/repeat track/no repeat button, with modern skins.
Sorry for the CAPS, but it is the best WinAmp release ever. All they add to the new versions of WA is trash. Did you know that it could play mp3s back in version 1.0 ? That is what I use my copy of WA for ... to play mp3s.
Just google for winamp 2.81 (or any other version you care to try). You'll find about quite a few links (make sure to use the google cache, and stick to winamp.com/aol.com servers)
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
Winamp doesn't play Mp3's as well as modplug... as mentioned in other posts (under this topic) it screws up the portemento and some other effects. It would be nice if there were a modplug-based player or a batch-mp3-encode plugin for ModPlug.
MODS?!?!
I remember those when I was in high school running great demos out of Finland, and all of that happened 10 years ago.
It's good to see they're still around, and kudos to Winamp for supporting them, but I wouldn't hold it against iTunes.
(though, the memory footprint, most definitely. I don't run Windows anymore so I wouldn't know firsthand)
Not to mention it doesn't even play MODs (like .XM et al). OK, that would make it unaffected by this vulnerability but it also makes it "a media player I don't want"(tm). ;)
I've found Foobar2000 to be the perfect alternative for me. Simple GUI, highly customizable and it gets the 'job' done.
>All I want it to do is play mp3's.. Yes but u gota have plug-ins to fade between songs and no gaps in between songs.
Here you go.
Belief is the currency of delusion.