← Advisories

Nullsoft Winamp 5.581 (wnaspi32.dll) DLL Hijacking Exploit

High
Advisory ID
ZSL-2010-4958
Release Date
26 August 2010
Vendor
Affected Version
5.581 (x86)
Tested On
Microsoft Windows XP Professional SP3 (English)
Summary

Winamp is a media player for Windows-based PCs, written by Nullsoft, now a subsidiary of AOL. It is proprietary freeware/shareware, multi-format, extensible with plug-ins and skins, and is noted for its graphical sound visualization, playlist, and media library features.

Description

Winamp 5.581 suffers from a dll hijacking vulnerability that enables the attacker to execute arbitrary code on a local level. The vulnerable extensions are .669, .aac, .aiff, .amf, .au, .avr, .b4s, .caf and .cda thru wnaspi32.dll and dwmapi.dll libraries.

Proof of Concept
Disclosure Timeline
N/A
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
26.08.2010Initial release
27.08.2010Added reference [1], [2], [3], [4], [5] and [6]
28.08.2010Added reference [7]
31.08.2010Added reference [8]
02.09.2010Added reference [9]
13.01.2018Added reference [10]