5 ms·

Oof, Winamp? Check this out: https://www.cvedetails.com/cve/CVE-2008-0065/ https://www.cvedetails.com/cve/CVE-2008-0065/

Dalewyn 3y ago
Why dafuq would I care about a bug related to a streaming service I've never even heard of when all I do is play locally stored music files? Incidentally, I still have not come across a suitable replacement for Winamp all these years later. They all have crappy UIs or bring features that I do not want and get in my way.
- Lammy 3y ago
  The best replacement for Winamp is… also Winamp! https://getwacup.com/ https://getwacup.com/
  - stOneskull 3y ago
    weird.. why isn't this copyright infringing? wacup seems to be using 'fair use'..
- dumpsterdiver 3y ago
  Fair enough. If you're only playing local files that were obtained from a trustworthy source then you wouldn't be affected. With a complete RCE like that though, I would definitely not advise playing music downloaded from peer-to-peer networks. While I'm not familiar with the exact requirements to exploit the vulnerability, I would err on the side of caution and assume that music files can be crafted that contain malicious metadata which can achieve similar results without actually being connected to the streaming service.
  - Dalewyn 3y ago
    The details are all right there: It's a vulnerability with the in_mp3.dll plugin (it's the decoder for playing MP3s), specifically with insufficient checks against malformed name and artist tags (probably ID3 tags?). It's fixed in Winamp v5.52 and above, and the version I use is v5.531 so I'm not affected as it turns out. I'm sure there are other bugs that I'm affected by, but again: Not really concerned about it.
    - dumpsterdiver 3y ago
      Yeah, to clarify, the part I wasn't sure about is if it was required to somehow integrate your local Winamp installation with the streaming service, or if it could be exploited simply by playing a downloaded music file. It sounds like it could indeed be exploited without being connected to the service.

Dalewyn 3y ago

Why dafuq would I care about a bug related to a streaming service I've never even heard of when all I do is play locally stored music files? Incidentally, I still have not come across a suitable replacement for Winamp all these years later. They all have crappy UIs or bring features that I do not want and get in my way.

Lammy 3y ago
The best replacement for Winamp is… also Winamp! https://getwacup.com/ https://getwacup.com/
- stOneskull 3y ago
  weird.. why isn't this copyright infringing? wacup seems to be using 'fair use'..
dumpsterdiver 3y ago
Fair enough. If you're only playing local files that were obtained from a trustworthy source then you wouldn't be affected. With a complete RCE like that though, I would definitely not advise playing music downloaded from peer-to-peer networks. While I'm not familiar with the exact requirements to exploit the vulnerability, I would err on the side of caution and assume that music files can be crafted that contain malicious metadata which can achieve similar results without actually being connected to the streaming service.
- Dalewyn 3y ago
  The details are all right there: It's a vulnerability with the in_mp3.dll plugin (it's the decoder for playing MP3s), specifically with insufficient checks against malformed name and artist tags (probably ID3 tags?). It's fixed in Winamp v5.52 and above, and the version I use is v5.531 so I'm not affected as it turns out. I'm sure there are other bugs that I'm affected by, but again: Not really concerned about it.
  - dumpsterdiver 3y ago
    Yeah, to clarify, the part I wasn't sure about is if it was required to somehow integrate your local Winamp installation with the streaming service, or if it could be exploited simply by playing a downloaded music file. It sounds like it could indeed be exploited without being connected to the service.