Inshell Security Advisory
http://www.inshell.net


1. ADVISORY INFORMATION
-----------------------
Product:        WinAmp
Vendor URL:     www.winamp.com
Type:           Pointer Issues [CWE-465]
Date found:     2013-06-05
Date published: 2013-07-01
CVSSv2 Score:   4,4 (AV:L/AC:M/Au:N/C:P/I:P/A:P)
CVE:            CVE-2013-4695


2. CREDITS
----------
This vulnerability was discovered and researched by Julien Ahrens from
Inshell Security.


3. VERSIONS AFFECTED
--------------------
WinAmp v5.63, older versions may be affected too.


4. VULNERABILITY DESCRIPTION
----------------------------
An invalid pointer dereference vulnerability has been identified in
WinAmp v5.63.

The application loads the contents of the %APPDATA%\WinAmp\links.xml on
startup (the key lngId="default") and while browsing through the
bookmarks in the Browser view of the GUI, but does not properly validate
the length of the string loaded from the "<link name>" and "<home url>"
keys before using them in a pointer call in the library gen_ff.dll,
which leads to a invalid pointer dereference condition with possible
code execution.

An attacker needs to force the victim to place an arbitrary links.xml
file into the target directory in order to exploit the vulnerability.
Successful exploits can allow attackers to execute arbitrary code with
the privileges of the user running the application. Failed exploits will
result in a denial-of-service condition.


5. PROOF-OF-CONCEPT (DEBUG)
---------------------------
Registers:
EAX E85130FF
ECX 00430043 winamp.00430043
EDX 00D1F5B4
EBX 00000000
ESP 00D1F598
EBP 00D1F5C4
ESI 023D3170
EDI 7C80934A kernel32.GetTickCount
EIP 073D0EE1 gen_ff.073D0EE1
C 0  ES 0023 32bit 0(FFFFFFFF)
P 1  CS 001B 32bit 0(FFFFFFFF)
A 0  SS 0023 32bit 0(FFFFFFFF)
Z 1  DS 0023 32bit 0(FFFFFFFF)
S 0  FS 003B 32bit 7FFDC000(FFF)
T 0  GS 0000 NULL
D 0
O 0  LastErr ERROR_SUCCESS (00000000)
EFL 00000246 (NO,NB,E,BE,NS,PE,GE,LE)
ST0 empty
ST1 empty
ST2 empty
ST3 empty
ST4 empty
ST5 empty
ST6 empty
ST7 empty
               3 2 1 0      E S P U O Z D I
FST 0000  Cond 0 0 0 0  Err 0 0 0 0 0 0 0 0  (GT)
FCW 027F  Prec NEAR,53  Mask    1 1 1 1 1 1

Stackview:
ESP-20   > 00000000
ESP-1C   > 00000100
ESP-18   > 00C1F444
ESP-14   > 7C9215F9  ntdll.7C9215F9
ESP-10   > 7C9215F9  ntdll.7C9215F9
ESP-C    > 00385D58
ESP-8    > 00163700
ESP-4    > 7C9215F9  ntdll.7C9215F9
ESP ==>  > 000000BE
ESP+4    > 00D1F5B4
ESP+8    > 00D1F5A8
ESP+C    > 00000003
ESP+10   > 00D1F5C0
ESP+14   > 00D1F5BC
ESP+18   > 00D1F5B8
ESP+1C   > 00D1FF14
ESP+20   > 00000900

Vulnerable code part (<link name>):
.text:07363F47                 push    ebp
.text:07363F48                 mov     ebp, esp
.text:07363F4A                 push    ecx
.text:07363F4B                 push    1
.text:07363F4D                 lea     edx, [ebp+var_4]
.text:07363F50                 push    edx
.text:07363F51                 lea     eax, [ebp+arg_4]
.text:07363F54                 push    0
.text:07363F56                 push    [ebp+arg_0]
.text:07363F59                 mov     [ebp+var_4], eax
.text:07363F5C                 mov     eax, [ecx]
.text:07363F5E                 call    dword ptr [eax]
.text:07363F60                 leave
.text:07363F61                 retn    8

Vulnerable code part (<home url>):
.text:073620F8                 push    ebp
.text:073620F9                 mov     ebp, esp
.text:073620FB                 mov     eax, [ecx]
.text:073620FD                 push    0
.text:073620FF                 push    0
.text:07362101                 lea     edx, [ebp+arg_0]
.text:07362104                 push    edx
.text:07362105                 push    [ebp+arg_0]
.text:07362108                 call    dword ptr [eax]
.text:0736210A                 test    eax, eax
.text:0736210C                 mov     eax, [ebp+arg_0]
.text:0736210F                 jnz     short loc_7362114
.text:07362111                 mov     eax, [ebp+arg_4]
.text:07362114
.text:07362114 loc_7362114:                            ; CODE XREF:
sub_73620F8+17j
.text:07362114                 pop     ebp
.text:07362115                 retn    8


6. SOLUTION
-----------
Update to latest version v5.64 or newer.


7. REPORT TIMELINE
------------------
2013-06-05: Discovery of the vulnerability
2013-06-06: Vendor acknowledgement of the issue
2013-06-11: Vendor provides custom build that includes a fix
2013-06-12: The issue is still exploitable
2013-06-12: Provided another PoC to clarify the way to exploit
2013-06-13: Vendor provides custom build that includes a fix
2013-06-14: Confirmation that the issue is fixed
2013-06-19: Vendor releases v5.64 which includes the fix
2013-07-01: Coordinated Disclosure


8. REFERENCES
-------------
http://security.inshell.net
http://forums.winamp.com/showthread.php?t=364291