Slashdot Mirror
WinAmp Security Hole Discovered, Patched
Sbarbero writes "According to Techworld.com, a significant security hole has been discovered in NullSoft's WinAmp, meaning everyone should upgrade to the 5.03 version the makers have just put out right now. Security company NGS has found that the exploit 'can be activated remotely simply by rendering a specially crafted html document' and will run arbitrary code - they have a full advisory on their site." Oddly enough, the vulnerability is in the playback for the classic .XM 'tracker' music format.
Systems Affected: Nullsoft Winamp versions 2.91 to 5.02 (possibly older versions, although this is not confirmed)
Hi from Napster! We've been tracking your listening habits and suggest the following music...Barry Manilow, Air Supply, Leo Sayer. If you act now and buy, we won't tell your friends or neighbors.
A feeling of having made the same mistake before: Deja Foobar
whether this affects the old 2.x series?
I am so tired of waiting.
Last time I checked, Winamp 5 used much the same amount of system resources as Winamp 2.
Winamp 3, on the other hand, is a whole different ball game.
The Human Cow - bringing you scrumtrelescence since 1995
I haven't used WinAmp in quite a while, so I can't remember. Does WinAmp allow dynamic loading of embedded content, as in: you play a song, which has an embedded script that opens an html document for you? I seem to remember one of the players doing this. I'm pretty sure Windows Media Player does this. If WinAmp does, it would make the problem much more dangerous.
Slashdot Syndrome: the sudden, extreme urge to correct someone in order to validate one's self.
Just do what I did, on 2.80:
Delete in_mod.dll from the "Plugins" directory.
Hole: Patched.
Who uses MOD/XM files anymore anyways?
It's hard for thee to kick against the pricks.
I use Irfanview with the "all pluggins" patch to play MP3 files and streams. Great light footprint media player and image viewer.
More music, fewer hits
http://www.foobar2000.org/
Being called a dork on Slashdot must be like being called the retard in special ed.
Not for me. The "Load file" dialogue that pops up when you click the "eject" button takes about 10 times longer to appear under Winamp 5. And since that's one of the only two buttons I ever click (the other being play/pause), I've always preferred 2.9x.
:-)
I'm prepared to accept that Winamp 3 was even worse though
bloated POS Winamp 5 player
You know your media player is too big when all the eye candy slows your older computers to the point they can't play mp3's without choking.
Slashdot Syndrome: the sudden, extreme urge to correct someone in order to validate one's self.
You can always upgrade to http://www.foobar2000.org/ instead. No more nonstandard interface, a decent mass-tagger, excellent replay-gain support, etc. What's not to like?
Belief is the currency of delusion.
Is WinAmp the free multimedia player of choice for Windows users? I know we've always talked about how Windows Media Player is eeeevil and RealPlayer is spyware. Where does WinAmp kick in? Does it do video or is it just a music thing? (like a free alternative to MusicMatch Jukebox or whatnot) It has been ages since I've follwed up (as a Linuxer I go between noatun and xmms)
Basically, I guess the question is how to make a strong case for WinAmp use. I already sing the praises of Firefox and recommend OpenOffice to folks who don't want/can't shell out $$ for MS Office. I recommend AVG as a free virus-scanner. Same with ZoneAlarm, Spybot S&D, and Ad-Aware. What winning argument do I use to say "use WinAmp instead of..." to Windows users who ask?
I can't believe people are actually complaining about winamp bloat. Winamp has been one of the better examples of not-bloat. Sure, 5 is worse than 2, but it's better than 3, and much of the CPU-hogging goes away when you go back to classic skins. For me, the enqueue function makes it well worth it.
I think the only way you can get less bloated is if you used something like mpg123. XMMS is a winamp-clone on linux anyway.
It doesn't just affect people who use the minibrowser. If you have Winamp set up as the default program for xm files, you're vulnerable. All someone would have to do is redirect the web page to a malformed page that sends a Content-Type: audio/xm (or whatever) header. This would execute Winamp, attempt to load the location, and cause problems.
You have enemies? Good. That means you've stood up for something, sometime in your life. --Winston Churchill
winamp3 was the bloated piece of crap. winamp5 is not a bloated piece of crap. they dropped wasabi. please check your facts before making posts.
If I remember, Winamp uses a modified version of Mikmod, a well known module player, which is also available in some Linux distro.
Will this bug be updated in mikmod as well ?
I hope that one day, Winamp will drop Mikamp and use Modplug instead, which sources has been released and it the best player on Win32 (mikmod sounds horrible on Windows, and is buggy).
Also modplug plays more formats and is better, although is win32 only;
I need a Sino-Logic 16. Sogo-7 data-gloves, a GPL stealth module...
Since version 2, Winamp has been notorious for playing MOD, XM, S3M, and related files inaccurately. It fudges up a lot of the effects, particularly portamento (note slide) and key-off commands. You all should be using ModPlug Player to play these formats! It ain't perfect but it's the best Windows player there is.
Why get this player? So that you can drink deeply from the cup of BBS\Internet history! Check out some MOD sites and dig some chippy goodness!
SHAMELESS PLUG -- Be sure to scope out my MODs as well!
Here's an idea to keep yourself free from these type of third party software security issues.
.XM files?) So, go to command prompt (or your favourite association editor) and type ASSOC and change the association of .XM files.. Pretty simple.. In fact, change all associations except .WAV, .MP3 and .MPEG (or whatever video/audio formats you prefer), that deal with Winamp.
Don't have it automatically load at boot. Simple! Next, change your association's to only load the files you want (for example, I don't know _anyone_ that uses Winamp for more then video playing and mp3's, what's with the
Another way to change file associations is to go into Explorer, "Tools" pull down menu, select "Folder Options", click the tab "File Types" and you can delete them from here.
Now this solves the loading problem, if it loads only when you click on your MP3 you don't have to worry about it leaving open ports (this goes for any third party software you don't need running all the time..). Not only will this prevent this sort of attack, but you'll get some freed resources, and a faster boot time, 'to boot'!..
Mod +5 Drunk
If for some reason it is impossible to download the updated version of
Winamp, the vendor has informed NGSS that it is possible to disable the
handling of Fasttracker 2 module files by taking the following steps:
1. Right click the Winamp player, go to 'Options' and then to
'Preferences...'.
2. In the new window which loads, go to 'Plug-ins' and 'Input'.
3. Look for the input plug-in items 'Nullsoft Module Decoder' and double
click it to bring up the 'Nullsoft Module Decoder Preferences' window.
4. Select the 'Fasttracker 2' loader and deselect the 'Enabled' checkbox to
the right of the loaders list.
5. Close all of the option windows and return to the main player.
back before mp3 was an option MODs were the shit. XM in particular had numerous things going for the format, including a nicely designed tracker (Fasttracker 2). I was into modding and tracking myself, but i stuck to Impulse Tracker. both programs are quite similar.. but to answer your question, is this a widely used format? it was. the digital music archive has numerous xm songs, if you're an unbeliever. i'm sure google has something to say about XM too.
Sig (appended to the end of comments you post, 120 chars)
Or you can follow the instructions at http://www.nextgenss.com/advisories/winampheap.txt to disable xm at a lower layer. (This is from a link from the techworld article.)
Knulla Kuk by Moby (the original Moby!)
Space Debris by Captain
Variations by Jogeir Liljedahl
Capslock by Mick Rippon
Jaunt by Wolfsong
These are just a few of many high-quality tracks that are out there. It's worth giving some a listen sometime!
Crap like this is why you should never use third party software like Winamp. Stick with Microsofts line of quality products and you'll be safe.
Seriously, just look at the time it took to fix this bug. I could almost read the entire headline before the fix. The bug took as long to fix as to read the comma between "Discovered" and "Patched". I expect better from Third Party software.
Until Third Party software is able to show they care about their products I can only recommend that you stick with 100% Microsoft Approved Solutions.
I don't need no stinkin' sig!
Just do a minimal install of 5.03 (without letting it integrate into the shell, etc) and copy the new in_mod.dll from /winamp5dir/plugins to /winamp2.91/plugins..
While you're at it; all the new and updated input plugins (in_mp3, in_midi, etc) seem to work just fine in 2.91.
Holy shit! Here's a reason not to upgrade:
in requirements:
500MHz Pentium III or comparable
One of the systems that I use winamp on is a Pentium-133 laptop that sits on my entertainment center and plays mp3's thru my stereo.
Why does it take a PIII-500 to play mp3's? It seems to be working fine on the p133 right now. Seems to me like too much extra bloat...
Place sig here.
Spyware and bloat???
Winamp certianly does not have spyware included in it! Real, MusicMatch and others may, but winamp has a very clean reputation. Since they're owned by AOL, an AOL icon is placed on your desktop (although the last time I used it, the installer actually PROMPTED you if you wanted it there!).
Winamp had bloat problems with version 3. It sucked. Everyone who's involved with winamp, even the developers, acknowledge this. Winamp 5 is MUCH better. With 'new' skins enabled, it takes up slightly more than winamp 2 (which didn't support 'new skins). Disabling the skins results in winamp 5 occupying LESS ram than winamp 2. This is quite an accomplishment, as winamp 2 has been around for many years. Any modern windows PC should be able to run it without a problem. Very few programs can make this claim any more.
If your computer can't spare the 5mb or so that winamp5 takes up, you need to consider an upgrade!
-- If you try to fail and succeed, which have you done? - Uli's moose
All I want it to do is play mp3's...
foobar2000 will serve your needs well. It does everything you could possibly want to do within the realm of playing music, and virtually nothing else. Low memory footprint/CPU requirements, simple and functional GUI (without fancy skins), and very powerful. Check it out.