Winamp 0-day Exploit Opens Backdoors

[tipo]

On the 15th of October, the BitDefender® labs came across four critical vulnerabilities affecting Winamp® 5.x. Shortly thereafter, several exploits piggybacking on these vulnerabilities were spotted in the wild. We won't go into detail about the first three, as they basically need no user interaction beyond loading them into the playlist, so here's a short run of the fourth one.

The "weapon" used by the cyber-criminals is a malformed MTM file – an audio file format similar to the MOD and MIDI file - distributed to different potential victims as e-mail attachments, or through social networking or peer-to-peer file sharing. Its purpose is to lure computer users into downloading and adding it to their playlist.

However from this point on, a little bit of social engineering is in demand since, in order for the exploit to trigger its payload, it is mandatory for the user to view the file info in Winamp. This is the action that sets the exploit contained inside the malformed MTM file into motion.

Long story short, as soon as the user views the file information, the exploit will initialize a backdoor service running on port 4444 and it will be ready to take connections from the outer world. The backdoor will be consequently used by an ill-intentioned person to easily gain remote access to your computer with the same privileges as the user running Winamp.

BitDefender detects the malformed file as Exploit.Winamp.D and will terminate it before the user is able to load it in the player. In order to stay safe from this type of exploits, you are advised to download files from trustworthy repositories only and never perform any actions on the computer if they have been requested or suggested by persons you do not know or trust.

youtube demo

[tipo]

:))

[HX1]

Winamp has had a couple of problems .. severe ones .. that they have ignored for several versions.. and quite some time.. bothersome..

[Marik]

My FiVE shall butthurt this new exploit