Slashdot Mirror
WinAmp Security Hole Discovered, Patched
Sbarbero writes "According to Techworld.com, a significant security hole has been discovered in NullSoft's WinAmp, meaning everyone should upgrade to the 5.03 version the makers have just put out right now. Security company NGS has found that the exploit 'can be activated remotely simply by rendering a specially crafted html document' and will run arbitrary code - they have a full advisory on their site." Oddly enough, the vulnerability is in the playback for the classic .XM 'tracker' music format.
But the press release says it affects ALL versions of WinAmp.
Systems Affected: Nullsoft Winamp versions 2.91 to 5.02 (possibly older versions, although this is not confirmed)
Last time I checked, Winamp 5 used much the same amount of system resources as Winamp 2.
Winamp 3, on the other hand, is a whole different ball game.
The Human Cow - bringing you scrumtrelescence since 1995
Just do what I did, on 2.80:
Delete in_mod.dll from the "Plugins" directory.
Hole: Patched.
Who uses MOD/XM files anymore anyways?
It's hard for thee to kick against the pricks.
I use Irfanview with the "all pluggins" patch to play MP3 files and streams. Great light footprint media player and image viewer.
More music, fewer hits
You can always upgrade to http://www.foobar2000.org/ instead. No more nonstandard interface, a decent mass-tagger, excellent replay-gain support, etc. What's not to like?
Belief is the currency of delusion.
You can .XM files into a HTML document and if WinAmp is set as the handler for that MIME type, it will probably automatically launch it (or something).
It doesn't just affect people who use the minibrowser. If you have Winamp set up as the default program for xm files, you're vulnerable. All someone would have to do is redirect the web page to a malformed page that sends a Content-Type: audio/xm (or whatever) header. This would execute Winamp, attempt to load the location, and cause problems.
You have enemies? Good. That means you've stood up for something, sometime in your life. --Winston Churchill
winamp3 was the bloated piece of crap. winamp5 is not a bloated piece of crap. they dropped wasabi. please check your facts before making posts.
You are probably not using the Classic skin then. I had the new modern skin turned on and it's a real pig. Go back to the Classic skin though and Winamp5 becomes the same as Winamp2
I used to track mods on the Amiga (protracker) and PC (Fast Tracker2). It was a fairly common occurence for people to load text/image files into songs as a playable instrument within a music module. You could then transfer the module (which contains both the instrument samples & the pointers to the coded music (it's all addressed through HEX!)) and then extract the datafile (save instrument as...) then view it in your favorite image viewer or text editor....
FYI:
Data files as instruments do not really sound as cool as you'd think though. If the file has header info, that's where you'd find the most variety and interesting sounds...
check out the "modarchive". it's widely used, but mostly in game software or by Amiga fetishists.
Since version 2, Winamp has been notorious for playing MOD, XM, S3M, and related files inaccurately. It fudges up a lot of the effects, particularly portamento (note slide) and key-off commands. You all should be using ModPlug Player to play these formats! It ain't perfect but it's the best Windows player there is.
Why get this player? So that you can drink deeply from the cup of BBS\Internet history! Check out some MOD sites and dig some chippy goodness!
SHAMELESS PLUG -- Be sure to scope out my MODs as well!
If for some reason it is impossible to download the updated version of
Winamp, the vendor has informed NGSS that it is possible to disable the
handling of Fasttracker 2 module files by taking the following steps:
1. Right click the Winamp player, go to 'Options' and then to
'Preferences...'.
2. In the new window which loads, go to 'Plug-ins' and 'Input'.
3. Look for the input plug-in items 'Nullsoft Module Decoder' and double
click it to bring up the 'Nullsoft Module Decoder Preferences' window.
4. Select the 'Fasttracker 2' loader and deselect the 'Enabled' checkbox to
the right of the loaders list.
5. Close all of the option windows and return to the main player.
back before mp3 was an option MODs were the shit. XM in particular had numerous things going for the format, including a nicely designed tracker (Fasttracker 2). I was into modding and tracking myself, but i stuck to Impulse Tracker. both programs are quite similar.. but to answer your question, is this a widely used format? it was. the digital music archive has numerous xm songs, if you're an unbeliever. i'm sure google has something to say about XM too.
Sig (appended to the end of comments you post, 120 chars)
Yes, According to the notice:
Systems Affected: Nullsoft Winamp versions 2.91 to 5.02 (possibly older versions, although this is not confirmed)
"Can of worms? The can is open... the worms are everywhere."
Or you can follow the instructions at http://www.nextgenss.com/advisories/winampheap.txt to disable xm at a lower layer. (This is from a link from the techworld article.)
Knulla Kuk by Moby (the original Moby!)
Space Debris by Captain
Variations by Jogeir Liljedahl
Capslock by Mick Rippon
Jaunt by Wolfsong
These are just a few of many high-quality tracks that are out there. It's worth giving some a listen sometime!
Just do a minimal install of 5.03 (without letting it integrate into the shell, etc) and copy the new in_mod.dll from /winamp5dir/plugins to /winamp2.91/plugins..
While you're at it; all the new and updated input plugins (in_mp3, in_midi, etc) seem to work just fine in 2.91.
Winamp is pretty much XMMS... It does video to.
/ mp3/frank el1.html
I recommend it as an audio player, but I like Media Player Classic for video.
history of Winamp:
http://www.time.com/time/digital/reports
Actually I think the fellows who made XMMS wanted a Linux version of Winamp... in fact XMMS skins are the same format as the old winamp skins.
Anyway... I like it well enough... I think it's suffered from bloat since Frankel sold NullSoft to AOL, but it's all good.
Get Winamp 2.X if you want just a good audio player.
Don't get Winamp 3 as it sucks memory like mad and has no real benefits.
Winamp 4 doesn't exist.
Winamp 5 is kinda like what Winamp 3 was supposed to be. It supports the pretty (and useless IMHO) new skins and is also very stable. It also has very nice internet TV video streaming. I run Winamp 5 because I have a Gig of memory and am not bothered by its 10-20 meg footprint.
There are also a whole heck of a lot of plugins for winamp to do various things like controlling it via remote control, ripping audio streams off the web and even have a little character dance on the screen.
-Derick
last time I checked WMP didn't cost anything either.
Any program distributed only with Microsoft Windows costs 150 USD or so for a Windows XP Pro OEM license. So does any Win32 program designed to bail if it detects Wine.
Who uses MOD/XM files anymore anyways?
For starters, most GameBoy Advance music is composed in those formats.
Holy shit! Here's a reason not to upgrade:
in requirements:
500MHz Pentium III or comparable
One of the systems that I use winamp on is a Pentium-133 laptop that sits on my entertainment center and plays mp3's thru my stereo.
Why does it take a PIII-500 to play mp3's? It seems to be working fine on the p133 right now. Seems to me like too much extra bloat...
Place sig here.
This quality karma whoring brought to you by toqerTV
Hot off #nullsoft
i don't even think the exploit is in our code
ron, is the exploit in the decoder?
isn't it in mikmod
When is the Mac version of this exploit coming out?
I am so tired of waiting.
hehe
i don't think we even wrote that xm decoder
*** Quit: statsbot (Ping timeout: 180 seconds)
*** Join: DrunkenMaster (DM@adsl-66-159-200-78.dslextreme.com)
`steev: the exploit was in the mikmod library that's used by in_mod for xm decoding
so its not even our code heh
yeah
there you go
it's not even our fault the exploit exists
So this isn't even a winamp bug, it's a mikmod bug.
Also modplug plays more formats and is better, although is win32 only
There's a port to XMMS. Works for me.
-Stephen
http://download.nullsoft.com/winamp/client/winamp2 81_full.exe
At least they still host it. (you can also s/full/lite in the URL)
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
Don't ever worry about individual Winamp plugins. They are self-contained and can be moved around at will. With the "in_***.dll" plugins, all that happens when you move them out is that you can't play the file types that they support. Move them back in, and you can play them again. Easy.
Just pull it out of your plugins folder and store it where you can find it, rather than renaming it. Just make a Winamp\Disabled directory, for instance.
Supported input formats:
;-)
* MPEG-4 AAC
* MP3
* MP2
* Musepack
* Ogg Vorbis
* WAV
* AIFF
* VOC
* AU
* SND
* CDDA
* FLAC
* Monkey's Audio
* WavPack
* Speex
* Mod
* SPC
* TFMX
* Shorten
* OptimFROG
* LPAC
* WMA
* AC3
* PSF
* NSF
* SID
* XA
* Matroska
picky picky...
I don't expect one program to do everything (well unless its EMACS). But you are right that there are some audio formats that still need work. However, for most users (most of their audio is in mp3 or some ogg) I think foobar2000 is already better than winamp.
This new version crashes hard (drwatson) after adding songs from a directory and then trying to play them in WinAmp.
Vulnerablity or not, I'm going back to the old version.
Dolemite
__________________________
Save the World! Use a Quote!
Nope, removing it from the file types menu won't work. The IN_MOD.DLL plugin will recognize .XM files automatically even if they have a different extension. So anyone who wants to exploit this hole just creates a .XM file and renames it .MP3. That's the best way for them to do it, too, since it's more likely your web browser is automatically configured to launch WinAMP for .MP3 files than it is for .XM files.