National Cyber Awareness System

Vulnerability Summary for CVE-2007-1922

Overview

The Impulse Tracker (IT) and ScreamTracker 3 (S3M) modules in IN_MOD.DLL in AOL Nullsoft Winamp 5.33 allows remote attackers to execute arbitrary code via a crafted (1) .IT or (2) .S3M file containing integer values that are used as memory offsets, which triggers memory corruption.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: MISC

Name: http://www.piotrbania.com/all/adv/nullsoft-winamp-it_module-in_mod-adv.txt

Type: Advisory; Patch Information

Hyperlink:http://www.piotrbania.com/all/adv/nullsoft-winamp-it_module-in_mod-adv.txt

External Source: XF

Name: winamp-inmod-code-execution(33480)

Hyperlink:http://xforce.iss.net/xforce/xfdb/33480

External Source: VUPEN

Name: ADV-2007-1286

Hyperlink:http://www.vupen.com/english/advisories/2007/1286

External Source: SECTRACK

Name: 1017886

Hyperlink:http://www.securitytracker.com/id?1017886

External Source: BID

Name: 23350

Hyperlink:http://www.securityfocus.com/bid/23350

External Source: BUGTRAQ

Name: 20070406 AOL Nullsoft Winamp IT Module "IN_MOD.DLL" Remote Heap Memory Corruption

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/464893/100/0/threaded

External Source: BUGTRAQ

Name: 20070406 AOL Nullsoft Winamp S3M Module "IN_MOD.DLL" Remote Heap Memory Corruption

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/464890/100/0/threaded

External Source: MISC

Name: http://www.piotrbania.com/all/adv/nullsoft-winamp-s3m_module-in_mod-adv.txt

Hyperlink:http://www.piotrbania.com/all/adv/nullsoft-winamp-s3m_module-in_mod-adv.txt

External Source: OSVDB

Name: 34431

Hyperlink:http://osvdb.org/34431

External Source: OSVDB

Name: 34430

Hyperlink:http://osvdb.org/34430

External Source: MLIST

Name: [dailydave] 20070406 AOL Nullsoft Winamp S3M Module "IN_MOD.DLL" Remote Heap Memory Corruption

Hyperlink:http://marc.info/?l=dailydave&m=117590046601511&w=2

External Source: MLIST

Name: [dailydave] 20070406 AOL Nullsoft Winamp IT Module "IN_MOD.DLL" Remote Heap Memory Corruption

Hyperlink:http://marc.info/?l=dailydave&m=117589949000906&w=2

External Source: SREASON

Name: 2532

Hyperlink:http://securityreason.com/securityalert/2532