<font face="Verdana, Arial" size="2">
SUMMARY:


Before any security mailing lists got wind of it, personnel from the
greyhat Web site K-Otik.com <http://www.k-otik.com/> discovered and
posted underground exploit code for a new Winamp vulnerability. The
vulnerability involves a specially-crafted Winamp skin file that can
automatically download and execute code on a victim's computer. By
enticing one of your users to a malicious Web page or sending an
HTML e-mail, an attacker could deliver his malicious Winamp skin to
your user's computer and gain total control of the machine. If you
suspect your users have installed Winamp version 5.04 or earlier
(whether or not you officially permit it), you should insist that
they remove Winamp. For other countermeasures, see the Solution
section below.

EXPOSURE:


Winamp, a very popular media player that supports and plays more
than 30 media file types, is used most commonly to play MP3 files.
Although Winamp is not a business application, we've found that many
employees install popular client applications like Winamp without
authorization. Even if Winamp isn't part of your official corporate
desktop image, some of your users probably have it on their systems.
Yesterday, the greyhat Web site K-Otik.com <http://www.k-otik.com>
posted underground exploit code
<http://www.kotik.com/exploits/08252004.skinhead.php>
for a new vulnerability that affects Winamp 5.04 and below. Usually
we report on vulnerabilities discovered by whitehat security
researchers who disclose flaws in order to inform and protect the
public. However, in this case a blackhat hacker calling himself
|silent released his new Winamp exploit to other malicious hackers
on the Internet, specifying that he would not inform Winamp or the
security community. Therefore, Winamp users should consider this a
high risk vulnerability, since malicious attackers have possessed
exploit code before the security community knew of it.


Winamp's popular skinning ability enables customizing the look and
feel of the application to fit your tastes. The malicious exploit
takes advantage of a design flaw in Winamp's Skin Zip (.wsz) files.
These .wsz files usually consist of a zipped archive containing
files that fall into two main categories: 1) Media files for
customizing Winamp, and 2) XML files that tell Winamp how to apply
the media files. However, |silent discovered that he could also
embed a malicious program within a Winamp skin file and then craft
the XML portion so that Winamp executes it automatically.


Internet Explorer becomes Winamp's unwilling accomplice in this
attack. |silent discovered he could create a Web page so that it
would automatically download an infected Winamp skin as soon as an
Internet Explorer (IE) user visited it. Windows associates .wsz
files with Winamp by default. That means a smart attacker could
maliciously craft his Web site so that if a victim visits the page,
the malicious skin file downloads via IE automatically and executes
in Winamp automatically. In sum, one wrong click could give up your
machine.

SOLUTION PATH:


Since |silent never disclosed this vulnerability directly to
Winamp's creators, Nullsoft, there is no patch correcting this flaw
(although you can bet Nullsoft knows of this issue by now). We plan
on updating this alert if Nullsoft releases a patch.


Today, the only way to totally protect yourself from this flaw is to
remove Winamp. If you do not allow Winamp in your network, consider
taking this opportunity to e-mail your users, citing the Winamp flaw
as another example of why they should not install unauthorized
programs on company-owned computers.


If you choose to continue using Winamp now, these workarounds can
mitigate your exposure to |silent's vulnerability:


* Dis-associate the .wsz file type in Windows.
Doing this prevents you from installing any new Winamp skins
automatically. To dis-associate .wsz files from Winamp, open
Windows Explorer and click Tools => Folder Options => File Types
tab. Scroll down to locate and highlight the WSZ extension type
(which appears only if you have Winamp installed). Highlight it,
and either click the Delete button to completely remove the WSZ
extension type or click the Change button and select some other
application, such as Notepad, to opens .wsz files harmlessly.


* Use another browser besides IE to prevent the automatic
download of the malicious Winamp skin. This is not a feasible
option for everyone. However, other browsers, such as Mozilla
Firefox, prompt the users for some interaction before
automatically downloading |silent's malicious Winamp skin.


* Firebox II, III, X and Vclass users should check below to
learn how to block .wsz files by using their WatchGuard proxy
services.


Though WatchGuard does not recommend installing Windows XP Service
Pack 2, we did test |silent's exploit under SP2. SP2 includes new
secure-browsing features that prevent IE from automatically
downloading certain files. With SP2 installed, the malicious Web
code |silent uses to download a Winamp skin onto your computer does
not work without significant user interaction.


-- For WatchGuard Firebox SOHO Users:


Since most administrators allow their users Web and e-mail access,
the workarounds above are your primary recourse.


-- For WatchGuard Firebox II / III / X Users:


If you're willing to block all Winamp skins, you can use the HTTP
and SMTP proxies to block Winamp's Skin Zip (.wsz) file type. See
below for specific instructions:


* SMTP Proxy
<http://www.watchguard.com/help/lss/70/Proxy/proxies3.htm>


* HTTP Proxy
<http://www.watchguard.com/help/lss/70/Proxy/proxies7.htm>


* Online Training Proxy Module
<http://www.watchguard.com/training/lss/50/Pages/proxies2.htm>


-- For WatchGuard Firebox Vclass Users:


If you're willing to block all Winamp skins from downloading, you
can use the HTTP and SMTP proxies to block Winamp's Skin Zip (.wsz)
file type. See below for specific instructions.


* SMTP Proxy
You'll have to create or adjust a custom Proxy Action based on SMTP-
Incoming in order to strip Winamp skin attachments. If you have
created your own Proxy Action based on SMTP-Incoming, you can edit
it so that it blocks .wsz files. In the Vcontroller software, click
the Proxies button and double-click your custom proxy action. Under
the Content Checking tab, change "Category" to Attachment Filename
and click either the Add to Top or Insert After button (only one or
the other will display). Next, type "WSZ Files" as the new rule's
name, and choose Pattern Match. Next to Pattern Match, type "*.wsz"
and select Strip as the Action. Now you can apply this new Proxy
Action to your SMTP rule to ensure Winamp skin files are blocked.


* HTTP Proxy
You'll have to create or adjust a custom proxy action based on HTTP-
Outgoing in order to strip Winamp skin attachments. If you have
created your own Proxy Action based on HTTP-Outgoing, you can edit
it so that it blocks .wsz files. In the Vcontroller software, click
the Proxies button and double-click your custom proxy action. Under
the Request Headers tab, change "Category" to Header Fields and
click on the Add button. Next, type "WSZ files" as the new rule's
name, and choose Pattern Match. Next to Pattern Match, type "*.wsz"
and select Strip as the Action. Now you can apply this new Proxy
Action to your HTTP proxy action to ensure Winamp skins are blocked.

STATUS:


There is no fix available short of removing Winamp.

REFERENCES:


K-Otik's Exploit Code
<http://www.k-otik.com/exploits/08252004.skinhead.php>


Secunia's Post Concerning the Winamp Vulnerability
<http://secunia.com/advisories/12381>

This alert was researched and written by Corey Nachreiner
</font>

<font face="Verdana, Arial" size="2">
Since |silent never disclosed this vulnerability directly to
Winamp's creators
</font>

<font face="Verdana, Arial" size="2">Originally posted by Dj Yoshi:
Dudders--it affects ALL versions of WinAmp. 2.80 included.

Though you should consider getting 5.04. MMD3 included.

</font>

<font face="Verdana, Arial" size="2">Originally posted by happydud:
I know it effects 2.8x as well, Yoshi. But 3 and 5 are still crap. I refuse to upgrade...

</font>

<font face="Verdana, Arial" size="2">Originally posted by JediHunter_X:
I have Firefox/iTunes, so I think I should be safe.

</font>

<font face="Verdana, Arial" size="2">Originally posted by Obi_Kwiet:
So, um, just our of um, curiosity, how would you take control of said person’s PC.
</font>

<font face="Verdana, Arial" size="2">Originally posted by DrkJedi82:
enhancer works with 5

</font>

<font face="Verdana, Arial" size="2">Originally posted by Obi_Kwiet:
So, um, just our of um, curiosity, how would you take control of said person’s PC.

Oh BTW fellow Massassians there's this great new skin for Win-Amp that you just have to dnl!

*note* for the more obtuse easily irritated individuals, this post is a joke.</font>

<font face="Verdana, Arial" size="2">Originally posted by GHORG:
I use 2.7, anyone lower than that?</font>

<font face="Verdana, Arial" size="2">Originally posted by Pagewizard_YKS:
strange, it didn't work w/ version 3 that came out a few years ago. its a damn good plugin, especially with the winamp disk writer feature that lets me enhance mp3s and then write the enhanced music as a .wav file, which can then be burned. People wonder why my music sounds better than retail, and its all b/c of enhancer.

</font>

<font face="Verdana, Arial" size="2">Originally posted by phoenix_9286:
And they borked all of the stuff that I liked in 2.X and added a bunch of crap I'll never use.

</font>

<font face="Verdana, Arial" size="2">Originally posted by Martyn:
Do you not find iTunes a bit of a resource hog? For me it just slooooooows everything down, and my laptop is fairly beefy.
</font>

<font face="Verdana, Arial" size="2">Originally posted by phoenix_9286:
Windowshading.</font>

<font face="Verdana, Arial" size="2">Originally posted by Martyn:
Do you not find iTunes a bit of a resource hog? For me it just slooooooows everything down, and my laptop is fairly beefy.

But I know what you mean about windowshading from the bottom edge screwing up your windows - it's does my nut in.

</font>

<font face="Verdana, Arial" size="2">
An Update To:
Winamp Flaw Allows Hackers to Skin Your Computer
30 August, 2004
On 26 August, we reported a newly discovered vulnerability affecting Winamp version 5.04 (and earlier versions). By enticing one of your users to a malicious Web page or by sending an HTML e-mail, a hacker could deliver a malicious Winamp skin to your user's computer that would automatically execute attack code, possibly gaining total control of your user's machine.
At the time of our first alert, Nullsoft had not released a patch or upgrade to correct this security issue. We promised we'd update you when Nullsoft released their fix. On Friday, Nullsoft released a security bulletin announcing that Winamp 5.05 corrects this skin vulnerability. Therefore, this is our promised update.
If you have chosen to allow the use of Winamp in your network, you should have all your users download and install Winamp 5.05.

</font>