Spyware Tunnels in on Winamp Flaw

Andy Philips writes "A security bug in Winamp is being exploited by miscreants to install spyware on machines running the media player software. "After surfing to a malicious Web site on our test machines, the file 'x.pls' begins to download, Almost immediately, Winamp starts to execute the play list and remote code execution begins." Sunbelt's Adam Thomas wrote in a posting. The Winamp problem affects version 5.12 of the media player. Earlier versions may also be affected."

Comments

It's that Damn Llama's Fault

[eldavojohn]

Once upon a time, I used Winamp.

And it was good.

It was fairly lightweight, I could load in huge playlists of college-napster-garbage without slowdown and I knew all the hot keys for searching and what not.

Then that llama came into the picture. I think it must have been version three or four (I can't remember) when there was a damned llama or alpaca or whatever in a green field. Now, I love llamas and alpacas, don't get me wrong. The problem was that now Winamp was about "graphix" and "features" that were once plugins that I didn't want.

I don't know why they thought Winamp needed to be able to play videos but it did now. I don't know why they thought Winamp had to show stupid tripping-on-acid-harmonograph visualizations but it did now. I don't know why they thought Winamp had to melt songs together but it did now ... etc.

On top of that, the memory footprint in Windows was crazy. And my roommate tried to put skins on Winamp that just made my computer shit its gourd. I was disgusted ... the hot keys may have still been there but what I was looking for in a media player was not. For some reason, they seemed to think that competing with Windows Media Player meant mimicking it to every detail. Fine. I never want to touch Windows Media Player, it's about as useful as my appendix. And now I feel the same way about Winamp.

Now there's a spyware flaw in Winamp. Am I surprised? Not really. They have gotten so complicated that there's probably a thousand holes in that application. They definitely lost site of what I was looking for--a plain jane slim audio player. Winamp's executing a remote method invocation through a playlist that can trigger itself to be automatically loaded and ran? Now that sounds like a "feature" I want my audio player to have.

Is this the first time this has happened? Nope, remember the zero day exploit that targeted skins in 2004? There's been a myriad of security issues with Winamp since it became more and more complicated.

"Gee, the way our audio player loads playlists isn't very secure. But it works and the people who use our application aren't interested in security--they're interested in playing AVI files on their audio player!"

So what would I recommend? Well, if you're using Linux, I can think of at least ten things better but XMMS would probably be my favorite. If you're running Windows, I like to use Quintessential Player which can be modified to be as complicated as new Winamp or can be

Re:It's that Damn Llama's Fault

[Robotech_Master]

Can't you get xmms compiled for Windows, too?

Personally, I use iTunes now, because it just works with my iPod. I could probably use something else, but why bother?

Re:It's that Damn Llama's Fault

[iezhy]

I used winamp too - until i found foobar2000

It supports virtually all posible audio codecs, and sound quality is much better

Re:It's that Damn Llama's Fault

[Anonymous Coward]

Once upon a time, I used Winamp.

Until there was a story on slashdot about spyware being installed via Winamp flaw. Someone posted to slashdot about the experiences they had with winamp, and suggested something called Quintessential Player. I love this person, because thanks to them, I just found a great replacement for winamp.

Re:It's that Damn Llama's Fault

[metarox]

Just for the record, Quinnware stopped the dev on the simple QCD player and started a bloated winamp 5 copy called Quintessential Media Player. Guess I'll be staying with the good old QCD 4.51 player for a long time.

Re:It's that Damn Llama's Fault

[Anonymous Coward]

While there isn't a Linux port of foobar 2000 yet, I've found Quod Libet to be a close-enough replacement for those of us who have gotten tired of whiz-bang graphics. Though mostly, I switched from xmms for the UTF-8 support (hey, that's the reason I switched from winamp too ;)

Re:It's that Damn Llama's Fault

[zerocool^]

For starters, you can go to www.oldversion.com and get winamp 2.95 along with a bunch of other versions. The train wreck that was winamp3 was also mostly corrected when they went to winamp5, and if you see from (http://www.winamp.com/player/free.php) there's a "lite" version that weighs in at 0.85MB, and which supports mp3, wav, ogg, au, midi, cda, aac, etc. Since it doesn't support modern skins, I would suspect that it's probably just a rehash of 2.9x

I don't use the video features of Winamp. They were present in 2.95, but they weren't bloated yet. And I don't think it was a grab at the windows media player headspace. It really seemed like they just tacked it on because it wasn't hard to do. I think it uses the windows renderer and codecs anyway, just without all the crap in WMP.

Anyway, yeah, I still use 2.95 of winamp, just like I still use instant messanger 4.8. I'm open to change; I'm just not going to "upgrade" to a bloated product. What is it with software these days, anyway? Every piece of software tries to be everything to everyone. Ugh.

~Will

Re:It's that Damn Llama's Fault

[catnap_seven]

This is looking promising.. 'QCD is compatible with Winamp DSP Plug-ins' - which means I can still use Enhancer 017.

Re:It's that Damn Llama's Fault

[Amouth]

version 3 was the train wrecke.. but i also belive it was about then that AOL bought it.. i use it all the time but it is an old 2.x version with the skin i like.. screw all the new vid crap.. it is a music player and that is what it should do

Re:It's that Damn Llama's Fault

[RonnyJ]

If you don't install all the extra plugins that come with Winamp 5 (media library, and particularly the 'modern skins' support), it's essentially the same speed/functionality as 2.95, but with tweaks/bug fixes.

I do find the Media Library very useful though, so I'm happy enough to have that installed.

Re:It's that Damn Llama's Fault

[Anonymous Coward]

I used winamp too - until i found foobar2000 [foobar2000.org]

It supports virtually all posible audio codecs, and sound quality is much better

From foobar2000.org:
Does foobar2000 sound better than other players?
No. Most of "sound quality differences" people "hear" are placebo effect (at least with real music), as actual differences in produced sound data are below their noise floor (1 or 2 last bits in 16bit samples). Foobar2000 has sound processing features such as software resampling or 24bit output on new high-end soundcards, but most of other mainstream players are capable of doing the same by now.

:-)

Re:It's that Damn Llama's Fault

[mancontr]

Have you recently used Nero? Why on earth a cd burning app need a image viewer?!

Re:It's that Damn Llama's Fault

[Jugalator]

Since it doesn't support modern skins, I would suspect that it's probably just a rehash of 2.9x

Basically, besides a ton of bug fixes and feature improvements, yes.

I recommend the latest Lite version for those that "just want WA 2", if not only to get fixes and improvements. As one can see from the size, it's far from bloated too.

Re:It's that Damn Llama's Fault

[Anonymous Coward]

Obviously the users were demanding it. That or the Nero developers have been trying to activly avoid adding useful features like Rockridge support, or HFS+ support. Who'd want that when you can look at the pretty pictures?

Re:It's that Damn Llama's Fault

[CastrTroy]

Did they code all their own codecs? Or do they use the standard codecs? Either way, I don't know how which application you use has any bearing on the sound quality. You can't make a badly encoded MP3 sound good.

Re:It's that Damn Llama's Fault

[BoomerSooner]

1999 called, they want their mp3 player back...

Jesus I didn't know winamp still existed!

Re:It's that Damn Llama's Fault

[mrdaveb]

I agree that Winamp 2 used to be great and Winamp 3 was horribly bloated. But what you really want to do is run the latest Winamp 5 with either the tiny Lite version, or the full version without modern skins. It has the same small memory footprint as Winamp 2... The only advantage of using Winamp 5 is that some of the recently discovered security holes have probably actually been in there the whole time and you might be putting yourself at risk if you run a really old version.

Re:It's that Damn Llama's Fault

[Sterling Christensen]

So what would I recommend? Well, if you're using Linux, I can think of at least ten things better

That page is old: "Last Updated 8 Apr 2000" and some of the links are broken.

Wikipedia has a nice media player comparison with an "Operating system support" table showing which ones run on Linux.

Re:It's that Damn Llama's Fault

[PACSADMIN]

Why on earth a cd burning app need a image viewer?!

maybe because some people use it to archive pictures, or to make picture CDs? i dunno, but it seems to make sense to me.

Re:It's that Damn Llama's Fault

[gregbains]

For all those interested here is the link: Quintessential Player

Re:It's that Damn Llama's Fault

[iceanfire]

i like the media library feature in winamp 5. its the only reason i upgraded to it. It automatically updates whatever directories you tell it to. Before you had to use playlists etc... now the media library is used to set up playlists.

Re:It's that Damn Llama's Fault

[gregbains]

The only reason I still use Winamp is the Internet TV function. Streams such as Futurama on EveryShowSucks keep me entertained, and without ads. As long as Internet TV remains free on WinAmp I will keep using it.

Re:It's that Damn Llama's Fault

[iceanfire]

thank you for pointing that out.... i wish i could mod you up

Re:It's that Damn Llama's Fault

[Anonymous Coward]

While foobar2000 is good and all, its not ANY better quality audio wise from any other media/music player that you can use.

Your statement is just wrong, and I'd thought I'd point that out along with a cut and paste from foobar's site FAQ just to prove a point


Does foobar2000 sound better than other players?

No. Most of "sound quality differences" people "hear" are placebo effect (at least with real music), as actual differences in produced sound data are below their noise floor (1 or 2 last bits in 16bit samples). Foobar2000 has sound processing features such as software resampling or 24bit output on new high-end soundcards, but most of other mainstream players are capable of doing the same by now.

Hope that clears that little "inaccuracy" up.

Re:It's that Damn Llama's Fault

[Anonymous Coward]

iTunes feels like an advertisement for music, built in store and everything. I don't like that.

My computer is my temple. The only advertisment on my computer should be through the webbrowser, to keep it as controlled as possible.

Re:It's that Damn Llama's Fault

[g253]

What is it with software these days, anyway? Every piece of software tries to be everything to everyone. Ugh.

ever heard of emacs?

Re:It's that Damn Llama's Fault

[Threni]

I tried that once and couldn't find the volume control. Have they fixed that? Is it a plug? I remember looking everywhere. Perhaps I'll give it another go - I usually use Winamp but I'm up for a lean alternative.

Re:It's that Damn Llama's Fault

[ShyGuy91284]

As I recall, isn't the old version of Winamp still available (Or at least it was before my 2 year tango w/ Linux)? And I rather like Winamp 5. Although I do agree it is quite a bit bloated. All the new features should have been implemented as plugins to the existing Winamp system so that it could still run on an older machine.

Re:It's that Damn Llama's Fault

[00lmz]

You can use the keypad + and - keys.

Re:It's that Damn Llama's Fault

[aconkling]

I don't know why they thought Winamp needed to be able to play videos but it did now. I don't know why they thought Winamp had to show stupid tripping-on-acid-harmonograph visualizations but it did now. I don't know why they thought Winamp had to melt songs together but it did now ... etc.

AOL.

Re:It's that Damn Llama's Fault

[georgevulov]

I'm listening to a stream using Winamp 5 right now (di.fm rocks) which has been playing for several hours. Total memory usage: 2500kb

Of course, I have disabled modern skin support, visualizations, the media library, and video playback, ect. If you're THAT outraged about the new features, take the 5 minutes to disable them instead of taking the 15 minutes to complain about it. I'm sure there are plenty of people who are very happy with the new additions; it's normal for the feature set of an actively developed program to grow.

Re:It's that Damn Llama's Fault

[geeber]

When installing Quintessential Media Player one can choose not to install the media library.

Problem solved.

Re:It's that Damn Llama's Fault

[Apathetic1]

A lot of people don't seem to be too clear on this so I thought I would mention it - WinAmp 5 is WinAmp 2 with bugfixes and some extra plugins (e.g. video). If you don't want the extra stuff just delete / don't install the plugins.

Re:It's that Damn Llama's Fault

[petermgreen]

i dunno why but winamp5 playing mp3 sounds horrible to me, maybe its something to do with the mp3pro support they added or something but every time i play a mp3 on it there is a harshness that i can't stand for more than a few minuites.

pretty much anything will sound better after that!

Re:It's that Damn Llama's Fault

[Apathetic1]

I can see your point but...

"needed to be able to play videos" - plugin
"had to show stupid tripping-on-acid-harmonograph visualizations" - plugin
"had to melt songs together" - plugin
"skins on Winamp that just made my computer shit its gourd" - plugin (modern skins, anyway - classic skins are a collection of static bitmaps)

I still use WinAmp. I also use iTunes. My WinAmp v5 installation looks more or less like my old WinAmp v2 installation because I've disabled and deleted the plugins I didn't want (like video and modern skins). The installer even asks you whether it should install all this junk and you can say no.

Don't get me wrong, I think WinAmp is past its prime but most of the bloat can be disabled.

Re:It's that Damn Llama's Fault

[Anonymous Coward]

strange, because winamp doesnt support mp3pro, and peter pawlowski author of winamp wrote the directsound output plugin for winamp. So are you suggesting there is something wrong with the standard iso mp3 decoding used in pretty much all mp3 decoders these days, winamp included?

Re:It's that Damn Llama's Fault

[Anonymous Coward]

I haven't used much beyond Winamp or iTunes, as Winamp is perfect for me, but in terms of memory footprint it doesn't even come *close* to iTunes. I had my girlfriend switch over for that very reason... iTunes would take 55 megs (out of a puny 256) for about 5000 songs even when idle and minimized; at that point, winamp only takes 5. And when playing and on the screen, its 55 vs. 25. So, at least among the two main players, winamp dominates that arena.

"If you're running Windows, I like to use Quintessential Player which can be modified to be as complicated as new Winamp or can be"

I thought you didn't like complex...?

Re:It's that Damn Llama's Fault

[psymastr]

High memory footprint? Winamp 5.08c is using 4 MB of RAM playing a song and having a playlist with around 30 songs loaded.

Re:It's that Damn Llama's Fault

[J_Darnley]

One can say the same about Winamp.

Re:It's that Damn Llama's Fault

[J_Darnley]

You must have only used real ancient versions. There was no version 4 of Winamp and Mike has been in every version have ever used.

Re:It's that Damn Llama's Fault

[xtracto]

Haha, I completely agree, just 10 mintues ago I read the comments here, while listening music with winamp. Niw I've just downloaded QCD and installed the "T0t4l pwn4g3" skin (one of the tiniest ones). I was looking for a media player that I could leave ONLY as a tray Icon, I read that for the Foobar one there was only a small patch but I didnt really liked that.

QCD is quite fine, the only downside again is that it has 23,648MB of private memory...

Re:It's that Damn Llama's Fault

[dr_eaerth]

I tried that once and couldn't find the volume control. Have they fixed that? Is it a plug?

This is what I use:
http://www.hydrogenaudio.org/forums/index.php?show topic=28665

You need to use columns UI, but that's not a problem because columns UI is nicer than the default UI. Very configurable.

Re:It's that Damn Llama's Fault

[hesiod]

> until i found foobar2000

I love Foobar, except for its randomization, which seems to suck. It just flipped back & forth from the first 1/4 of the list and the last 1/4 of the list, picking up one from the middle every 5th or 6th selection. Now, it may be bad luck, since even with truly random selections, it could play in the listed order, but I've seen it happen a few times.

Re:It's that Damn Llama's Fault

[Anonymous Coward]

QCD is quite fine, the only downside again is that it has 23,648MB of private memory

Agreed. A 23.6 GB memory footprint is just a little heavy for a mere audio player application ;-)

Re:It's that Damn Llama's Fault

[Anonymous Coward]

My fav player is xmplay - http://www.un4seen.com/
Lightweight, assignable hotkeys for everything, super-accurate support for old MOD formats, and more.
sadly it's Windows only...

Re:It's that Damn Llama's Fault

[Crilen007]

Did you see the LITE version? It doesn't play vids, it doesnt have modern skin support. Its the basic version.

Re:It's that Damn Llama's Fault

[Threni]

Cheers. I'm giving it another go. I'll have to force myself to use it to get used to it, but it's a lot cleaner than Winamp.

Re:It's that Damn Llama's Fault

[gordgekko]

They have old versions (pre v3) over at Oldversion.com.

Re:It's that Damn Llama's Fault

[DDLKermit007]

Ummm...you do know you can disable the store too right? Plus if your like me and you like to search for music allot the iTunes store is quite good for that. iTunes always runs on my machine so when I'm either just browsing for music I don't goto some chaotic online database of music "users" made, but the one that apple made and then go directly to isohunt with band name & album in hand. Works as long as the music is just a little bit mainstream though. Indie stuff I have my record store friends for.

Re:It's that Damn Llama's Fault

[juiceCake]

Why bother? In your case, as you said, personally, you're using something you like. Personally, I can't stand iTunes on Windows because it installs Apple's QuickTime player. I prefer the alternate QuickTime player, and iTunes is huge and hideous. But personal tastes differ.

Re:It's that Damn Llama's Fault

[Nico3d3]

"It was fairly lightweight, I could load in huge playlists of college-napster-garbage without slowdown and I knew all the hot keys for searching and what not."

This is exactly what Foobar2000 is doing now... Althought it's a little bit harder to configure than Winamp, it's a lot lighter.

Re:It's that Damn Llama's Fault

[NoMoreBS]

Anyone interested in a free player (yes, it plays ogg vorbis etc) with no bloat and excellent search ability should try Musikcube.

Re:It's that Damn Llama's Fault

[strider44]

So what would I recommend? Well, if you're using Linux, I can think of at least ten things better but XMMS would probably be my favorite.

I'm waiting for someone to suggest Amarok for Linux. It's most definitely the best player I've ever used.

Re:It's that Damn Llama's Fault

[Syrrh]

Heck, why'd you stop using it? I rather like the tiny memory usage, simple file management and minimal clutter. I don't want to screw around with playlists and visualizers! (or even skins and equalizers) I just want a player to sit unobtrusively in the background and run music like it's supposed to.

So I keep a copy of Winamp2.35 around and install it on every system I use. The size of its installer is measured in kb. Installing an updated version of Winamp is like trying to add glossy features to Notepad. Why bother?

Re:It's that Damn Llama's Fault

[Yocto Yotta]

Yeah, no kidding. Even RealJukebox (pre-realone) was better than what Winamp has turned into. Christ, that's a statement and a half right there alone.

Re:It's that Damn Llama's Fault

[shawb]

Maybe you installed a faulty plugin. I've seen this before with things such as auto-levelling software, 3rd part GEQs and other audio plugins.

Oh

[kvant]

I was wondering why my mp3-collection was suddenly trying to sell me penis-lengthening pills!

Re:Oh

[Belseth]

I was wondering why my mp3-collection was suddenly trying to sell me penis-lengthening pills!

Wait'll the next version comes out. They'll be collecting credit card numbers and automatically billing your account so you won't even have to order the enlarging pills they'll simply show up in your mailbox along with the bank notice that your account is empty.

Re:Oh

[Hogwash McFly]

I could swear 20 Fingers' Short Dick Man was never on this playlist before!

Re:Oh

[Anonymous Coward]

I was wondering why my mp3-collection was suddenly trying to sell me penis-lengthening pills!
Have you been walking around nude in front your webcam while Winamp was open? If so, it may be very "targeted" advertising...

Re:Oh

[Firewalker_Midnights]

I would have to assume it's because you have Ricky Martin mp3's on there... That's really the only explanation. (Oh Minudo, how thou hast failed me...)

Re:Oh

[krakelohm]

Winamp did not put that stickie on your monitor, that was your wife.

So now it...

[Robotech_Master]

...whips your computer's ass, as well as the llama's.

Re:So now it...

[Rosyna]

Well, it's not just Winamp. Seems no one can get this format correct. Even iTunes had a problem http://lists.apple.com/archives/security-announce/ 2005/Jan/msg00000.html although whether it was actually exploitable or not is something else.

Re:So now it...

[LifesABeach]

"A security bug in Winamp is being exploited by miscreants..."

Who else has the time?

Re:So now it...

[Ced_Ex]

"A security bug in Winamp is being exploited by miscreants..."

Who else has the time?

Anarchists, bohemians, script kiddies, heathens, zealots...

Download link to latest version.

[Futurepower(R)]

Link to WinAmp Free Player.

Re:Download link to latest version.

[Dwedit]

Here's some information guaranteed to piss off the Winamp employees:
Change the download URL from this:
http://download.nullsoft.com/winamp/client/winamp5 13_full_emusic-7plus.exe
to this:
http://download.nullsoft.com/winamp/client/winamp5 13_full.exe

Then there's no more Emusic bundle. This url is not listed anywhere on the site.

Re:Why don't they make a law...

[LiquidCoooled]

Because there is nothing wrong with fucking up your own computer.
There is nothing wrong with telling people how to fuck up their computers as well.

There is however something wrong if you use these tools to automatically fuck up other peoples computers.

Vulnerability is optional

[quentin_quayle]

I know you will all correct me if I'm wrong, but if you don't have the .pls as a trigger for Winamp as a plugin, you're not vulnerable. Just set your browser to do something else with .pls (like offer to download). Or trash the file type association or set it for something other than Winamp.

Or if you're a luddite like me and can't stand plugins, prevent them all from working by commenting out the plugins lines in:
C:\Program Files\Common Files\mozilla.org\GRE\ [version here] \greprefs\all.js

This is assuming you use Mz or FF for web on Windows like a sensible person.

Re:Vulnerability is optional

[Anonymous Coward]

This is assuming you use Mz or FF for web on Windows like a sensible person.

That's funny, I thought all the sensible people moved to Linux a long time ago. GTK Firefox or Konqueror is a lot saner. On my box there's no spyware, no viruses, and no convicted monopolist's junk. Life is pretty damn good.

Re:Vulnerability is optional

[Jugalator]

I know you will all correct me if I'm wrong, but if you don't have the .pls as a trigger for Winamp as a plugin, you're not vulnerable. Just set your browser to do something else with .pls (like offer to download). Or trash the file type association or set it for something other than Winamp.

Or upgrade your Winamp to 5.13.

Re:Vulnerability is optional

[yoyhed]

Know what else is funny? I don't remember this discussion being an OS debate. We've all heard your argument before, we all know Linux is less susceptible to spyware, and we know Microsoft was determined to be a monopoly by the courts.

The grandparent poster's suggestion was assuming the user had Windows because the discussion is about fucking WINAMP, a WINDOWS program. I'd say anyone using Windows who was sensible would indeed use Firefox (or Opera), as the GP said.

You don't need to jump on every comment that mentions Windows and promote Linux in such a zealous/inflammatory fashion, especially when the comment about Windows was helpful and was promoting OSS like Firefox.

This all depends...

[Anonymous Coward]

on you setting your browser to automatically using WinAMP for certain filetypes. Just alter or remove the links within your browser (assuming FF)

Move Along

[Billosaur]

As usual, nothing to see here...

From ZDNet Asia: The flaw was disclosed on Monday, when Winamp maker Nullsoft, a division of America Online, released an update to fix it. The company posted version 5.13 of Winamp, while Secunia and other security companies issued alerts about the problem. Secunia rated the issue "extremely critical," its highest rating.

Flaw detected and removed. New version of Winamp out. Get the new version. Protected. Not much more difficult than that. Shouldn't there a be a "Software Vulnerabilties" section to Slashdot, where these things could be posted?

Re:Move Along

[Anonymous Coward]

What happened to the days of patching? I don't know anything about the new version of WinAmp but this exploit vs. upgrade cycle seems to be a vehicle for prodding users to move to the latest edition of the bundled adware/spyware/malware product. So you get it through exploit or you get it through bundling. What's the difference anymore?

Re:Move Along

[RonnyJ]

Shouldn't there a be a "Software Vulnerabilties" section to Slashdot, where these things could be posted?

That's certainly an option, however Winamp is a hugely popular media player. I'm sure many Slashdot readers have Winamp, and wouldn't visit such a section regularly, so fairly 'big' stories like this should at least be posted to the front page too. At the very least, I know now that I need to update Winamp.

Re:Move Along

[sn0wflake]

Approximately a week ago I started Winamp and instantly received a message that there was a new version available. What to do? Upgrade! Problem solved. I still don't get what the big deal is about this "news" other than the usual Windows bashing from Slashdot.

Re:Move Along

[Anonymous Coward]

I still don't get what the big deal is about this "news" other than the usual Windows bashing from Slashdot.>/i>

Isn't that exactly why we all come here?

Re:Move Along

[scanner_darkly]

The same thing happened to me. I'm baffled as to why this is news. Nullsoft, like practically any company out there, released code with bugs in it.

As soon as the code was found, a patch was released and the company prompted casual users to download the update.

What exactly is the big deal here?

Re:Move Along

[Tim C]

As usual, nothing to see here...

Flaw detected and removed. New version of Winamp out. Get the new version. Protected.

Well, there's that much to see - if you use Winamp, you should download the latest version. Now I don't use Winamp, but before I read this article I didn't even know there was a vulnerability, let alone a fix for it. In that sense, there's certainly something here for me to see.

Re:Move Along

[Anonymous Coward]

There already is, its called CERT http://www.us-cert.gov/cas/techalerts/TA06-032A.ht ml/
From February 1, 2006.

Re:Move Along

[geekee]

"Flaw detected and removed. New version of Winamp out. Get the new version. Protected. Not much more difficult than that. Shouldn't there a be a "Software Vulnerabilties" section to Slashdot, where these things could be posted?"

Yeah, because Winamp has an autoupdate feature, right?

Re:Move Along

[towsonu2003]

That's certainly an option, however Winamp is a hugely popular media player. I'm sure many Slashdot readers have Winamp, and wouldn't visit such a section regularly, so fairly 'big' stories like this should at least be posted to the front page too. At the very least, I know now that I need to update Winamp.

These days, I really am happy with the update notification of the Linux distros. You don't need to follow the development of each and every package (winamp, winword, excel, outlook, firefox, acroreader, openoffice etc.) for your own security. They do it for you!

Re:Why don't they make a law...

[CyricZ]

A legal solution to a technical problem will never work. The involvement of politicians likely won't lead to secure consumer-grade software.

The best thing to do is to use technologies that encourage secure programming. We're talking about garbage collected languages, for instance, that reduce the risks of buffer overflows. And beyond that, start using BSD or Linux rather than Windows. Of course the list goes on and on.

Foobar2000

[Idimmu Xul]

A small plug for the greatest MP3 player in existance, Foobar2000

It's so awesomely customisable, it hurts.

Re:Foobar2000

[SilentTristero]

I used to run FB2000, but switched to Media Monkey. Best MP3 manager/player/jukebox I've ever seen. For instance: you have two Zappa albums, one under Zappa, Frank and the other under Frank Zappa. Just drag the second album into the first artist name and it automatically retags all the files' artist names.

Also scales easily to the 10,000 track range while still being fast, and has excellent device connectivity options. Plus it's fully scriptable.

(I have no relation to it other than very happy user)

Re:Foobar2000

[NightLamp]

I downloaded this,
installed it,
imported the mp3 directory,
started playing a song,
tried to change the volume... ... and no volume control!

scanned the preferences to no avail.
uninstalled.

greatest mp3 player in existence?
no sir.

Re:Foobar2000

[Anonymous Coward]

I seemed to find it with no trouble.

If you aren't smart enought to find the volume control, you don't deserve to use foobar.

Memory usage

[Anonymous Coward]

More of the same.

Slashdot runs winamp?

[CRC'99]

Woah, they even got the might dot! My quip down the bottom was System going down in 5 minutes.

Nice work!

There are other applications to use

[hcoder]

It should be noted that no application is secure enough (except some 'Hello World!' implementations). It's not unusual that one should get hotfixes, service packs, etc. to keep ones system (relatively) secure against crackers. If you like winamp get the update and relax. As other folks said you may use other applications, mplayer is my favourite one. Of course I run it on Linux.

Re:There are other applications to use

[mrsbrisby]

It should be noted that no application is secure enough

Except qmail.

Meanwhile the rest of the world thinks that they have to choose between functionality and security and manage to get neither particularly well.

Re:There are other applications to use

[Anonymous Coward]

"no application is secure enough ... It's not unusual that one should get hotfixes, service packs, etc"

I'm not disputing what you say is largely true in reality. It's just that what you say, and the reality behind it really suck massively. By repeating and reinforcing this viewpoint you contribute to the slack and pathetic attitude behind why so much software is total shite these days. What's more, why are you acting as an apologist for these clowns? Because you 'like' the program. Please! I've had jobs writing life and death code for safety critical applications in ADA, used Z and VDM, and read countless papers on program proving and so on. In fact it is theoretically impossible to prove most programs, but you can get it down to 99.9999% or so, to a point where the harware is likely to fail because of an alpha particle more than the program is likely to go wrong. My point is simple. Quality code IS possible. Quality code is not even substantially more expensive than shitty code (especially during its full lifecycle - unless the company is a cut and run job) if you are geared up to producing it through well managed SE practices from the outset. Quality code is rarely made because of human failings, not technical ones. If every coder that wrote buggy, insecure code got a swift round to the back of the head then eventually ALL coders WOULD write perfect code. That's a fact (both ways you interpret it). By churning out the old line about how everybody should expect a few bugs you propagate the rotten meme and you create a tolerance to shoddy workmanship. That tolerance and the line between acceptable and unacceptable keeps getting pushed further and further, most all windows software is a serious risk these days. It's not a question of whether there are exploits, just a question of finding the ones that are surely there. Before I go off on my old man rant about how all coders are script kiddies these days, how you could all do with a kick up the ass, how it was better in my day..blah blah... I'll say just this... stop propagating this foul defeatist idea that software is INTRINSICALLY BUGGY. It isn't, it takes a bad coder to make bad software. I know it serves our purposes as programmers to have the world believe that, but we should hold ourselves to higher standards, if only for our own sanity. Happy coding.

Re:There are other applications to use

[Ced_Ex]

I've had jobs writing life and death code for safety critical applications in ADA, used Z and VDM, and read countless papers on program proving and so on. In fact it is theoretically impossible to prove most programs, but you can get it down to 99.9999% or so, to a point where the harware is likely to fail because of an alpha particle more than the program is likely to go wrong. My point is simple. Quality code IS possible. Quality code is not even substantially more expensive than shitty code (especially during its full lifecycle - unless the company is a cut and run job) if you are geared up to producing it through well managed SE practices from the outset.

The main difference here is that "life and death code for safety critical applications" are typically run in isolation, away from all things the programmer can't account for.

If quality code is so easy to accomplish, we would already have completely secure OSs, browsers, emails, etc. but we don't, because reality says it's really hard to do. Not because we're not trying, it's because there are too many possibilities to consider in an open environment.

Strange

[Anonymous Coward]

Isn't this like reporting on something exploiting an old bug in xmms or likewise?

A fixed version of Winamp was released even before any of the mainstream media had published their reports. Isn't this rehashing the same?

Winamp 5.12 and older are vulnerable? Wasn't this the point of the original article? What does this have to offer than the same old story when it comes to all software. Upgrade to remove those nasty bugs.

I believe you can find the fixed version here, its been there for a week:

http://www.winamp.com/player/

Interesting

[db32]

So this is the sound of the internet crashing? It even comes with a playlist!

last exploit I remember of winamp

[British]

Was when that disaster known as Winamp TV came out. Porn site operators found out rather quickly you could incorporate pop-up ads when you connect to their streams. A simple preference change stopped this.

Re:last exploit I remember of winamp

[evilviper]

last exploit I remember of winamp Was when that disaster known as Winamp TV came out.

Disaster? NSV streams are the ONLY decent internet TV channels I've come across. Some channels like "Freedom TV" have very good content most of the time. Other channels like the "'50's commercials" channel is good for killing a few minutes too. Other channels vary in quality from program to program, but are often interesting, at least. I wouldn't recomend throwing away your TV because of them, but it's a lot better than the crap streams available elsewhere.

Fortunately, you don't need Winamp... MPlayer does a fairly good job with NSV streams, so you only needed Winamp so you could make a playlist of all available streams, and then send that to your non-Windows system. Now there are programs like streamlister so you don't even need Windows/Winamp for that part.

Porn site operators found out rather quickly you could incorporate pop-up ads when you connect to their streams.

The pop-up was just a symptom, not an exploit by any stretch. The security hole was than Winamp would automatically open it's built-in browser to the URL specified in the stream, and the built-in browser uses Internet Explorer... Yes, a preference change eliminates this.

Now I know..

[PaulMdx]

..why there's no screenshots on the website. I just installed the Normal version. Not the prettiest app I've ever seen.

Re:Now I know..

[Idimmu Xul]

http://img141.imageshack.us/img141/7189/poobar4ks. png

how pretty does it need to be?

Re:Now I know..

[Matt Perry]

My install doesn't look anywhere near as nice as that. So how did you get yours to look like that?

Re:Now I know..

[Inda]

I prefer my install to have the plain look. It's hidden by other windows or minimized most of the time anyway.

I like it for the very low CPU usage and memory footprint. It easily displays 10,000 tunes on my old P3 450mhz. I reckon an old 233mhz would cope fine with it too.

The customisable, RegEx style playlist display formats are also great (if a little complex).

If you need an MP3 player, that also plays every other type of audio format under the sun, then get Foobar2000. An audio player that just plays audio well.

Re:Now I know..

[Anonymous Coward]

Hey, a fellow Popul Vuh / psych fan! I trust you know the blogs.

Re:Now I know..

[Anonymous Coward]

I can't believe I spelled "Popol" wrong. Sheesh!

That should solve the problem, but...

[Anonymous Coward]

...do we need a clean install, or can we just slap this baby on top of the old one?

Re:That should solve the problem, but...

[J_Darnley]

You can always slap the new on on top of the old one. The tech support forums reccomend to do a clean install if you manage to screw the installation up some how.

The inevitable debate as to its usefulness

[Anonymous Coward]

As usual something like this immediately conjures up a discussion on whether one should use winamp (with a whole lot of geeks who "used to use it before it got ze bloat").

I just want to point out that I still use it as my primary video and audio player in xp and its fantastic. For a while there I was skeptical about the bloat but its back to its fast operation now.

For audio it is fine, does the job and always has.

For video it is almost as good as VLC. Sometimes it drops the ball and VLC bails me out.

All in all a good product.

Problem?

[towaz]

This was patched over a week ago, http://www.incidents.org/diary.php?date=2006-01-31 (bottom).
The time from exploit to patch was very fast.
better then the length it takes other software developers to release a patch..
http://www.eeye.com/html/research/upcoming/index.h tml

Earlier versions may also be affected.

[Anonymous Coward]

why so detailed?!

anyone know if this is a 5.x problem? I still use 2.91. couldn't find any reliable info anywhere :(

Re:Earlier versions may also be affected.

[oni]

I use 2.60. Old versions of winamp were really great. They load up instantly, have a tiny memory footprint, and do everything I want to do. My friends use iTunes, and it's true that some of the features are great, but when I just want to play one file winamp is faster and better.

Anyway, to answer your queston, so long as you don't have a browser plugin you shouldn't be vulnerable.

Re:Earlier versions may also be affected.

[Anonymous Coward]

hm browser plugin... in my browser, .pls is associated with winamp (with download dialog, does not open automatically). I'm not sure to what kind of plugin you're referring, but I need to know if the bug existed in earlier versions / 2.x.
ah, found something: The vulnerability has been reported in version 5.11 and does reportedly not affect prior versions.

http://secunia.com/advisories/18649/

thanks anyway!

Re:Earlier versions may also be affected.

[SleepyHappyDoc]

I'm running 2.95 on a spare box. If someone can provide an evil link, I'd be glad to test it out for ya.

Winamp 5 == Winamp 2

[Anonymous Coward]

Winamp 5 is essentially just an updated version of Winamp 2 renamed so that it would have a higher number than the trainwreck that was Winamp 3. There's no reason not to upgrade - all the "bloat" (modern skins, video support, media library, whatever) is an install-time option. Even with all the "bloat", I find that so long as I use a classic skin, its reasonably lightweight. (Modern skins, of course, eat up more CPU/memory).

If you're still using 2.95, you're probably vulnerable to a host of security issues and missing out on a number of useful features (better AAC/mp4 support for one, I believe). I highly reccomend upgrading to 5.13.

Re:Winamp 5 == Winamp 2

[zerocool^]

I don't understand why this is a "security risk" anyway. I mean, I guess if your browser is set to automatically accept when a website sends you a file, and automatically run it... then, maybe. Maybe in the same way that you could have your browser set to automatically accept, download, and execute a .com file. But, my browser doesn't download files without asking, and it doesn't execute them either. And the only pls files I use are from di.fm.

Re:Winamp 5 == Winamp 2

[Anonymous Coward]

I don't understand why this is a "security risk" anyway.

Winamp itself can access the web. It has nothing to do with your web browser.

Re:Winamp 5 == Winamp 2

[Zerathdune]

yeah, this was my thinking. I really don't give a fuck about winamp security because:

a) winamp doesn't need to touch the internet, so I don't let it do that anyways
b) the only way anything is even going to get as far as fucking with winamp is if I manually open it in the program, which I don't tend to do with non-music files from outside the official winamp site.

and maybe it's more bloated than it used to be, but I haven't noticed, perhaps because the machine I'm using it on has an althlon 64 and a gig of ram. I don't do gaming on my other machines, so they don't run windows anyway.

Maybe This Will Get People's Attention

[Anonymous Coward]

Maybe this will get your attention as to why the current methods using the tag are awful. This tag need to be deprecated and replaced with something that allows the user more control. This very same method could also be used to exploit vulnerabilities in WMP as well, so it's not as simple as picking a different application.

The user needs to be able to control the behavior of embedded media regardless of the plug-ins installed. No plug-in should be able to override the user's ability to control how embed tags work. It's abused in all kinds of annoying ways. Ever try to visit a site with an embedded quicktime movie, yet it fails to work on a Mac because the tag points to a Windows application with a specific CSLID? Yeah... Annoying.

What's more is that certain vendors (*cough* Apple *cough*) further encourage this behavior - and thereby purposely put their users at risk - by doing things like burying the actual links to the stream inside a quicktime file that has to be downloaded first.

Still lite

[Bizzeh]

winamp is still lite, you dont HAVE to install the extra features.
you dont HAVE to install the library,
you dont HAVE to install the modern skin support,

remove those 2 and your practicaly using winamp 2.9 with alot of bug fixes and speedups... so i dont see what all the complaining and whining is about

Version 5.13 Already Out

[Ranger]

That information would have been useful had WinAmp not told me that version 5.13 was already available. A WEEK AGO!

I don't know what's worse on Slashdot, a dupe, a roland, or old news.

Re:Version 5.13 Already Out

[Sporkinum]

I don't know if it takes a special port for update notification, but here on my computer at work, it has never notified me. I just checked and it was configured for notification.

Re:Version 5.13 Already Out

[WWWWolf]

That information would have been useful had WinAmp not told me that version 5.13 was already available. A WEEK AGO!

But if you had read the article blurb, you might have noted the article was about a security flaw, not a new Winamp release.

Plus, there's always people who like to say "no, please don't upgrade that thing, you're just going to shove more bloat to my eyes, dammit."

Re:Version 5.13 Already Out

[ChildeRoland]

If they thought that, they'd still be using WinAmp 2.9 anyways.

Re:Version 5.13 Already Out

[ChildeRoland]

"I don't know what's worse on Slashdot, a dupe, a roland, or old news." Since everyone seems to see the dupes and old news, I'd have to say a Roland. Afterall, I only poke my head out every once in a while.

Re:Version 5.13 Already Out

[assassinator42]

It said there was a critical security flaw on the update notification. I think most people who care about security should've checked that out.

Re:Version 5.13 Already Out

[/dev/trash]

I loved you in Wizzard and Glass.

Winamp

[certel]

Winamp is now just bloatware. With all the features added to the software, the stability dropped like a rock. I was an avid user until I purchased an iPod and have been using iTunes ever since.

Re:Winamp

[Anonymous Coward]

Just so I'm clear, you're calling Winamp "bloatware", and iTunes is a svelt, minimalistic application?

Re:Winamp

[theurge14]

I was using iTunes before I got my iPod. When I realized that I was using about 4 or 5 buggy and bloated plugins to get a useful interface out of Winamp I knew it was time to ditch it. It was painful at first, because I learned about the MP3 world with Winamp and I knew nothing else. But I look back now and am glad I did.

Re:Winamp

[Anonymous Coward]

When I heard that iTunes had been released for PC, I tried it. Once. Opened task manager saw that it was using 30mb of memory and immediately uninstalled it. My install of version 5 has everything but modern skin support (so I have media library, video support, some plugins like milkdrop) and uses less than 3mb. And its a smaller, less obtrusive interface. I don't think thats bloatware at all. Minus the itunes music store I'd definitely say that winamp is much more flexible. Plus I have my machinae supremacy skin for it, and Milkdrop is like the best visualization plug in of all time (I just like the fancy flashing colors..) Winamp 3 sure did suck though, but of course they aactually sort of appologized for that a bunch of times already.

Re:Winamp

[arafel]

Er... so you find iTunes less bloated than winamp? You have a strange definition of bloated... :-)

Re:Winamp

[Anonymous Coward]

Winamp is now just bloatware.....
And then you post:
and have been using iTunes ever since.
ROTFL!

Re:Winamp

[Anonymous Coward]

Er... so you find iTunes less bloated than winamp? You have a strange definition of bloated... :-)

I was thinking the same when I read that. But Apple has a strange way with creating perceptions of their products.

Like all the posts you can find pointing out that iTunes may use DRM, but at least it is a more friendly/liberal DRM than others. But it isn't! The other major music stores have at least (and often more so) as friendly/liberal DRM policy as Apple (compare number of simultaneous copies/machines, burns, portabel devices, portability, redownloads of lost/deleted music, etc.). But where does the prevalent perception come from?

And confusing the issue...

[jnik]

This has absolutely nothing to do with Sunbelt Computer Systems, their PL/B implementation, or PL/B source files (extension .pls). (Oh, the fun I had keeping WinAmp from opening my source code....)

TFA is short on details

[Anonymous Coward]

How exactly does this exploit work? What versions of Winamp are affected and which if any are safe?

Do I have to have Winamp open while surfing to be infected? Do I have to actually use Winamp's viewer to get to the infected file to be infected?

Finally, is there such a thing as a competant journalist? I'm starting to think the abnswer is "no"...

(MRC[?]="onrush")

Workaround is meaningless

[Anonymous Coward]

What kind of lameness is that? This story isn't about the impact on compusavvy tinkering mechanics... its about the impact on the other millions of people who run Windows and don't know shit.

Your work around sucks, anyway. If you tell the browser to download the .pls file... and then click to play it... and your WinAmp once again goes to work, then you're fucked. But I guess that shows you are one of the millions of people who...

javascript, always (*(&^JAVASCRIPT

[Anonymous Coward]

Well, after clicking through to various links to see how this worked, because it isn't clear in this article, I found out this is yet another frikkin javascript exploit. You have to click the link yourself OR just have javascript turned on.

When will people admit that JS is the modern day badguy culprit? Over and over and over again, I don't care what groovy effects you (any of you web devs, talking to YOU) can do with it it's a SECURITY NIGHTMARE. Admit reality! You can't make it secure, if you force your visitors to use JS they will have it turned on all the time, then they go to a bad page and get nailed. How the hell are random surfers supposed to know your pet JS is OK but this other web pages isn't? Huh? You couldn't do it either no matter how leet you think you might be, so why make non coders try to guess? That's what it is, you are forcing people to be psychic in order to surf. It doesn't matter if YOUR page you code is pure as puppies and the driven white snow, you are MAKING your visitors surf insecurely on purpose because you INSIST on them having JS turned on to use your site. Even if they have the various script plugins to ask them, how the hell are they supposed to know BEFORE they click on it? Anti malware software is AFTER THE FACT.

Re:javascript, always (*(&^JAVASCRIPT

[slowbad]

Since the wide cross-section of webpage statistics I view always seems to show 97%
of the browsers having this enabled, the "solution" is a non-issue.

The people I've set up who care about safer browsing have accepted my turning off
Javascript in IE6 and leaving it on with Firefox. They are free to choose whichever.

And if a webpage cannot display with either client -- they don't need to got there.

Re:javascript, always (*(&^JAVASCRIPT

[Anonymous Coward]

84985984985965985984988565265

2.91 Vulnerable?

[Anonymous Coward]

Does anyone know if Winamp 2.91 is vulnerable? Is there anywhere I can download a proof-of-concept to check?

Irony

[Anonymous Coward]

From TFA:

"SpySheriff will display a false warning that the computer is infected with spyware."

Anyone else see the complete irony in that?

Blame AOL, not Nullsoft

[lightyear4]

While, Winamp was indeed improved between versions 3 and 5, I still prefer the 2.x series and XMMS for their no-nonsense approach to music. After all, its the music we care about. The reasons for winamp's decline are many, but if you watch the developments at Winamp's Nullsoft, it gives you quite a few clues. Winamp's creator Justin Frankel is no longer affiliated with Nullsoft, and if you track the developments leading to his departure, its quite clear why winamp has suffered as well. When Nullsoft was bought by AOL in 1999, big-corporate philosophies took over and the informal nature of Nullsoft was destroyed. Coincident with this was the bloating of a once great media player. C|NET has an article about Nullsoft and Frankel's departure with some good outside references.

Re:Why don't they make a law...

[Anonymous Coward]

And beyond that, start using BSD or Linux rather than Windows.

Uhh yeah; I'll get right on that. Just as soon as the numbers make any sense at all.

start using bsd or linux LOL... yeah... that's cute.

No LUA Support

[giorgosts]

I installed winamp after I elevated my LUA as an admin, on on my profile folder instead on \Program Files\ and then demoted my account. Does this mean that winamp runs now as root? Am I vulnerable?

(ot) Re:Now I know..

[tehshen]

I just installed the Normal version. Not the prettiest app I've ever seen.

1) It fits in with your current theme, so if you're using the toy Windows XP theme, it's going to look like that.

2) Nobody thinks that's a good answer, so if you want a better-looking foobar you'll need Columns UI (which you get if you downloaded Full) and see the faqs for it. You can get formatting strings here. (Azrael is sexy.)

Meh

[HunterZ]

Winamp is just a backup player for me now. Mostly I use Media Player Classic because it uses AC3Filter to Dolby-Surround decode my MP3s to 5.1.

Just one question

[SuperKendall]

Are there more computers running OS X than there are active copies of WinAMP?

If so, why are there currently no OS X viruses yet when we see an active WinAMP exploit?

Food for thought.

Re:Just one question

[Anonymous Coward]

Food for thought.
Yeah, thoughts such as to how such crap gets modded 5+ "Insightful/Interesting."

Ok I use OS Anonymous, there are more OS Anonymous users then Windows Application XYZ, and no viruses have been made for OS Anonymous(yet). A flaw finaly shows up in Application XYZ, and that is just "food for thought" on how secure and great Anonymous OS is?

Rip that appart all you like, but I seriously have to ask what is with the flawed logic used here for stuff like OSX security claims?

and the GOOD NEWS is....

[holywarrior21c]

and The good news is~

Feminist Pioneer Betty Friedan Dies.... People online

What WinAmp really needs

[Simonetta]

What WinAmp really needs is to be very small in footprint. Two: every, yes, every function should have a keyboard combination interface.
    With a keyboard combination for each function, a remote can be made for the Winamp player. Use a photodiode that decodes the 38KHz signal sent from all TV remotes. Feed this signal into a microcontroller that replicates the WinAmp keyboard combinations according to button pressed on the remote. Plug this microcontroller into the PC in parallel with the keyboard (use TTL gate ICs). Now you can use your PC as a music server with a remote. Now all we need is either a laptop with an external keyboard input or a very quiet-low power consumption desktop PC.
    But none of this is possible if the programmers don't put a keypress combination for every function of the program.

Re:What WinAmp really needs

[ZzzzSleep]

Quoth Simonetta

every, yes, every function should have a keyboard combination interface.... But none of this is possible if the programmers don't put a keypress combination for every function of the program.

In WinAmp hit "Ctrl + P" for the preferences menu. Go to Global Hotkeys in the General Preferences menu, and add whatever keypress combinations you feel like. This is for WinAmp 5 btw, I don't know if it's used in earlier versions.

Quintessential Player?

[Futurepower(R)]

Anyone have experience with this: Quintessential Player?

Note that it says you can rip CDs at full speed. WinAmp requires you to pay to do that.

Again?

[Craig Davison]

Winamp is the Internet Explorer of mp3 players. It's had a massive amount of vulnerabilities. This is the third playlist vulnerability alone: see the other two. Are they going to do a code audit, or will we see the same kind of vulnerabilities again and again?

I moved to a player with a good media library years ago. Even if that's not for you, consider something like Foobar2000.

Re:Again?

[DemonThing]

> Winamp is the Internet Explorer of mp3 players.

Is it not Windows Media Player?

Re:Again?

[Anonymous Coward]

So you are showing me a 6 year old bug in winamp2 and a bug in winamp3? Thanks.

Re:Again?

[Craig Davison]

So when Winamp 6 comes out with a playlist buffer overflow, you won't be surprised.

Screw Winamp

[Anonymous Coward]

I've recently moved over to java-based jlGui
http://www.javazoom.net/jlgui/jlgui.html
http://sourceforge.net/projects/jlgui/
It's cross-platform, portable, (USB thumb drive, anyone?) and it plays local mp3/ogg files, Shoutcast streams (*.pls), and Winamp playlists (*.m3u)
It's great for running at my work where I have a personal network drive that follows me from PC to PC. I never need to install anything... I just double-click the jar file.
I highly recommend giving it a shot if you're sick of updating Winamp all the time.

Do Lamas dream about buffer overflows?

[Anonymous Coward]

Once upon a time, a shitty unsafe little language called C was invented.

Its greatest contribution to history has been buffer overflows, overruns,
desguised as useful applications or OSs...

Our beloved C++ could have mended all that, given us a safer higher
level language to program applications with...

http://en.wikipedia.org/wiki/Buffer_overflow

"C and C++ provide no protection against accessing or overwriting data in any part of memory through invalid
pointers; more specifically, they do not check that data written to an array (the implementation of a buffer)
is within the assumed boundaries of that array."

Either we are ALL morons that can't program decent apps or we are being sabotaged by the languages we use?

Alternative players

[alexo]

How come nobody mentioned VLC or Media Player Classic yet?

an example of security by design

[Anonymous Coward]

How many remote explots for mac classic OS are out there? If someone had file sharing turned off, are you going to own their machine remotely via some exploit? Go ahead, try and list them. All I have ever seen is exploits that run as clients, not as pwned servers. And it's not like there wouldn't have been serious street cred to have come up with the first mac classic exploit, because then all the leet windows and unix guys could have laughed and laughed for years over it. A few viruses, sure, they exist, outright take over exploits? Ha! yuo f4!l it!

The reason why it never happened is because it was incredibly hard to do. Simple as that. coded and designed to be secure and easier to use than what existed at the time, and it worked. Early apple failed at marketing, not at coding.

    Say what you want about classic, some is real, bad memory management for instance, but lack of inherent default security wasn't one of them. You just plain ain't hacking a mac classic box unless you are physicaly sitting at the keyboard when the owner isn't looking.

Re:Screw Pockets

[Anonymous Coward]

I've recently moved over to java-based jlGui ... and it plays local mp3/ogg files

I've recently moved over to a Hummer-based coin-holder and it carries my two quarters when I walk to the box 50 yards down the street to buy a newspaper.

Hurray!

[iamlucky13]

Wow, you pretty much echoed all of my thoughts in elegant form

I actually still use Winamp 2.73. I keep meaning to upgrade to 2.95, but I guess that'll probably happen next time I buy a computer.

I do find the comments others have made about being able to disable/delete in version 5+ the extra useless crap that was added in version 3, and may actually try that. I did stick version 5 on my computer at work, and I definitely appreciate the fact that I can keep my classic skins.

PS - I believe an alpaca is a particular breed of llama. That is, they are all the same species and can interbreed to produce fertile offspring.

Re:Hurray!

[shawb]

From Wikipedia: Alpacas and llamas can (and do) successfully cross breed, the resulting offspring are called huarizo.

They're not the same species, but can breed. And more succesfully than a horse and a donkey can breed together. Basically, the interfertility test has gone out of favor with biologists; there have been far too many exceptions shown, and indeed some odd hybrids which are more prolific than either parent individually.

Re:Hurray!

[Zerathdune]

interesting. so how does one make the call now?

Re:Hurray!

[shawb]

Hmm, it's quite complex. I was a little vague in my prior post. Most species are indeed reproductively isolated from each other (That is, they generally can not or at least will not breed together.) The classification of species can get quite contentious, and it often has quite large impact whether or not a given group of animals is indeed a seperate species due to the endangered species act.

One particular group in contention is the red wolf. There are few enough red wolves left that if they are indeed their own species, they would be considered endangered and therefore be afforded protection under the endangered species act. This means there are restrictions on development in the red wolf's habitat, etc.

The problem comes in that red wolves can mate with gray (timber) wolves under certain circumstances, and red wolves can mate with coyotes. In fact, if you can get a gray wolf to mate with a coyote, the result is pretty dang close to a red wolf. Gray wolves generally do not mate with coyotes in nature, but there are exceptions. In captivity it becomes a lot more likely, and artificial insemination yields pretty consistant results. So one could argue that, according to the reproductive seperation theory the red wolf is not a unique species at all. In fact one would even have to combine the gray wolf and the coyote into one species.

So, of course this means that there becomes political debate over the exact definition of species. To conservationists, it is obvious that the red wolf is its own distinct species, and deserving of protection under the endangerd species act. To the development interests, it is quite blatant that the red wolf is simply a gray wolf/coyote hybrid or even the median in a range of morphologies between wolf and coyote. and nothing to really worry about when making policy decisions.

The real answer is that because species arise gradually from evolution, there is really no sharp point where you can say "These different groups are now seperate species." However for law to be just, it must be consistant. To be consistant, there must be distinct deliniations between different groups. These sharp distinctions, unfortunately, do not really exist anywhere in nature. (Okay, I'm ready for the "Wrong: species are the kinds that god created/the FSM reached out and touched with his noodly appendage" posts.)

One of those things where the answer simply raises more questions, I suppose. At least it's not Quantum physics, which you don't learn so much as get used to.

So what, get a grip

[voxel]

Use Winamp v2.0 then.

There is no reason you have to upgrade.

I hate it when people think because a software product was modified, that they are FORCED to use thus said modifications.

You seem to think the old WinAmp was stable, secure, fast and light weight... SO USE IT.

Jeez. I use Winamp 2.10

[Fantastic Lad]

It was the latest one out when I was putting software on my system.

It works flawlessly. It's teenie-tiny. It's appealing to look at. . .

Am I missing something here. . ? The only reason I ever go for updates on software is in the hope that an annoying design flaw is fixed, or that a much-needed feature will be added. When I finally load something onto my machine which does exactly what I want, I sigh with relief and then move on to other interests.

I'm fairly certain guys like me are not well liked around the headquarters of Commercialism Inc.

Software doesn't crap out after 2 years of use, but I guess with everybody so well programmed into thinking, "Old=Bad", that even when consumers step into the virtual world, they don't need to own products filled with time-bomb parts designed to fail after a set period. People are kind of chumpy this way. As my grampy used to tell me, "Buy it good, buy it once, learn how to fix it yourself."

Of course, that doesn't mean people shouldn't create new things for the sake of play; Playing means seeing what can be done next, what innovation can be whipped up. Playing is fun. But for computer music players, I don't really care. I have music. It plays. Why all the fuss?

People like to fuss.

-FL

Just one more question

[SuperKendall]

Ok I use OS Anonymous, there are more OS Anonymous users then Windows Application XYZ, and no viruses have been made for OS Anonymous(yet). A flaw finaly shows up in Application XYZ, and that is just "food for thought" on how secure and great Anonymous OS is?

Why the Anon post?

The point is that many people claim OS X is not a target for virus writers beccause the numbers are too small. Yet the numbers for Winamp are smaller - so why do we see a virus for Winamp and not for OS X?

The reason it was modded up is not because it says anything about OS X being secure or not. It's an honest question with interesting implications if even lesser used applications on another platform are being used as attack vectors when a whole OS platform itself remains clean. Why?

An alternative to winamp...

[In Fraudem Legis]

Alternatively, you can use Coolplayer, cuz it's as lite as it gets. http://coolplayer.sourceforge.net/ And I agree, Winamp2 used to be the best (music) player....

Baby/bathwater error && hysteria

[Ignominious]

You can use C/C++ to do anything you like.

There are still many times when C/C++ is the best choice, sometimes the only high-level choice for some chips.

Your summary of the languages is frankly ridiculous. You forgot to mention what your reasoning might similarly condemn hand written assembly code as being even more insecure than C, what with JMP #memory_addr, despite _still_ being used with almost every piece of electronics you can buy. You can write bad, insecure code in any language.

If you use a decent toolkit instead of the standard C libraries and you have reasonable time to debug and know how to use the languages properly (e.g. use assert) then you can write stable efficient software which will still run on machines 10 years old with = 64Mb RAM (why should basic computer users upgrade their hardware when they only do email, word processing, web browsing?). A worthwhile tradeoff?

In C++ you can have stuff like array bounds checking with the STL or with a toolkit compiled in debug mode.

Also, you might not like seeing a segfault message but with 'safer' languages you might get no message, even though the program had done something wrong.

With a decent OS, i.e. not running everything with full privileges, application buffer overruns aren't of themselves that bad without bad software design; with system services they typically need/want the extra efficiency that C/C++ can provide.