Foo - WinAmp users: update your WinAmp.

The bad guys have discovered a nifty exploit for WinAmp. You can get the fixed 5.13 version from http://www.winamp.com/player/

From McAfee's writeup of the vulnerability:


This detection covers a 0-day exploit targeting WinAmp 5.12 that allows remote code execution via a specially crafted play list (.pls) file. Such exploit files could be executed with little user intervention (such as visiting a website that hosted malicious files), and the end result could be the silent installation of any number of viruses, trojans, and potentially unwanted programs.

winamp stinks IMO. iTunes all the way

ITunes is HORRIBLE IMO....WinAmp all the way!!! :)

Thanks for the heads up....I'm updated!

good job!

According to the article, I'm safe. Winamp 2.93 has neither the vulnerability nor the bloat.

According to the article, I'm safe. Winamp 2.93 has neither the vulnerability nor the bloat.I hope you're right about 2.93 not having the vulnerability :) Here is Sunbelt's Blog writeup of an instance of WinAmp exploit that's being used to infect systems with both SpySheriff and a CWS variant :mad:

http://sunbeltblog.blogspot.com/2006/02/winamp-exploit-found-in-wi_113891339953448796.html

Screenshots included, for the eyecandy-oriented folks.

According to the article, I'm safe. Winamp 2.93 has neither the vulnerability nor the bloat.

Everybody "said" that when WinAmp 5 was coming out.....but I switched over and don't notice any significant bloat over the old 2.x versions.

Thanks for the link. Given the method it attacks (buffer overrun in the playlist) there actually is a pretty good chance that mine is vulnerable. I'll just have to be careful where I stream music from. CWS is one of the really annoying adware programs.

The installer for winamp 2.x is 1.87 MB. The installer for winamp 5.13 is listed by CNET as 5.27 MB (2.8 times the size). I know there's more features, but I'm happy as is and I don't have as much RAM as I'd like anyway.

WMP For the win :p I remmeber back when I used to use winamp.

winamp stinks IMO. iTunes all the way

I'm with you. WimpAmp has too many security holes and allows too much spyware to get installed on client computers. Itunes is fantastic!!!!!!!!!

Winamp? spyware? wth
Don't run your computer as an administrator and you don't have to worry about 97% of spyware being installed.

I haven't read the article. Do you have to manually run the playlist or is it something that works automatically?

I haven't read the article. Do you have to manually run the playlist or is it something that works automatically?
From what i read, the danger would come from listening to playlists from streamed radio stations.

From what i read, the danger would come from listening to playlists from streamed radio stations.
Oh. Well I guess I'm safe, then. I probably should update. I'm just lazy.