Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
Bug

WinXP and WinAmp Vulnerable to Malicious MP3s 505 505

mypenwry writes "Foundstone, a Mission Viejo, CA security services company, is reporting several vulnerabilities that would allow malicious code embedded in MP3 and WMA files to be executed via WinXP and WinAmp. WinAmp versions 2.81 and 3.0 are vulnerable to buffer overflows via certain long ID3v2 tags when MP3 files are loaded. More troubling is the WinXP vulnerability: A buffer overflow exists in Explorer's automatic reading of MP3 or WMA (Windows Media Audio) file attributes in Windows XP. An attacker could create a malicious MP3 or WMA file, that if placed in an accessed folder on a Windows XP system, would compromise the system and allow for remote code execution. The MP3 does not need to be played, it simply needs to be stored in a folder that is browsed to, such as an MP3 download folder, the desktop, or a NetBIOS share. This vulnerability is also exploitable via Internet Explorer by loading a malicious web site. Explorer automatically reads file attributes regardless of whether or not the user actually highlights, clicks on, reads, or opens the file. Windows XP's Explorer will overflow if corrupted attributes exist within the MP3 or WMA file. Microsoft has issued a fix for this vulnerability. Nullsoft has posted fixed version of WinAmp 2.81 and 3.0 on their web site."
This discussion has been archived. No new comments can be posted.

WinXP and WinAmp Vulnerable to Malicious MP3s

Comments Filter:
  • Uh Oh (Score:5, Insightful)

    by Jaysyn (203771) on Thursday December 19, 2002 @10:41AM (#4922505) Homepage Journal
    I hope no one tells the RIAA about this. They will be putting landmines in P2P soon.

    Jaysyn
    • Re:Uh Oh (Score:5, Funny)

      by Jugalator (259273) on Thursday December 19, 2002 @10:53AM (#4922606) Journal
      Uh oh. I think they already infected my computer when I d/l:ed some christmas mu*?DZMV*Z@@@@+++ KNEEL BEFORE HILLARY ROSEN +++""!##""!1!!1.

      NO CARRIER
    • If the RIAA use these tactics the solution is simple...

      Wait a few months until the RIAA's trojanized files are well and truely spread throughout the P2P networks...

      then use the thousands of trojanized nodes to DDOS the RIAA

      *chuckle*

    • Convenient that downloaded "pirated" music files are now potential attack vectors. So much more effective an argument for DRM ("If it was legal and properly signed, you'd have nothing to worry about.").

      I wonder if the EULA on the MS patch for this will be overreaching and invasive?

      • by Didion Sprague (615213) on Thursday December 19, 2002 @11:58AM (#4923063)
        Which brings me to a slightly off-topic question (but not that far off-topic): won't it take just a single compomised DRM file on whatever platform to completely send the whole DRM concept -- at least the generation with the single compromised file -- down the toilet?

        I mean, it would seem to me that Microsoft's DRM -- or DRM in general -- is based somewhat on "human" trust. Once that trust is abrogated -- just once -- the whole thing spirals into a "well, it's still pretty secure" type of situation -- and then sprials into "wait'll next generation's DRM. It'll be secure as hell."

        I know no cryto scheme is 100% -- at least in theory -- but because the consumer/DRM stuff is being built up and hyped so much lately, it seems that its potential -- potential for complete security, potential for complete failure -- far outstrips the more practical, usability/crackability aspects.

        And then I wonder: once this sort of consumer/DRM is launched mainstream, it'll become -- eventually -- embedded into the economic model for distribution. But once this DRM stuff is cracked or broken or whatever happens, the DRM itself will fall apart, as well the economic model. And companies who go balls-out to invest in this stuff -- and work hard to secure the "human" trust aspect of it -- will be in dire, dire straits -- economically, technologically, you name it.

        DRM is like a massive WMD waiting to be let loose. It's failure -- assuming it fails at least once a generation -- will sink more companies than I think anyone realizes.

        Just some thoughts.

  • Don't worry (Score:4, Funny)

    by Psmylie (169236) on Thursday December 19, 2002 @10:43AM (#4922520) Homepage
    This is all part of the Berman Bill [digitalspeech.org].
  • by Anonymous Coward on Thursday December 19, 2002 @10:43AM (#4922526)
    So, now when the users are afraid because of having virii in their mp3s, they are not stupid anymore?
    • "So, now when the users are afraid because of having virii in their mp3s, they are not stupid anymore?"

      It's a good argument to get your friends to finally switch to ogg vorbis. I haven't encoded an mp3 since vorbis beta 3 (which was well before RC3) anyway.

      • by doofusclam (528746) <slash@seanyseansean.com> on Thursday December 19, 2002 @11:17AM (#4922757) Homepage
        Thats a feeble excuse for switching to Vorbis regardless of the merits of this format. It's like saying "They found vulnerabilities in Apache so i'm gonna change my webserver to something else"

        I'm sure there are exploitable buffer overflows in Vorbis too but as the format is so little used (relatively), hackers ain't looking for them. The day Vorbis is more popular than mp3 is the day the hackers change what they're targeting.

        seany
        • by Blkdeath (530393)
          I'm sure there are exploitable buffer overflows in Vorbis too but as the format is so little used (relatively), hackers ain't looking for them. The day Vorbis is more popular than mp3 is the day the hackers change what they're targeting.

          Much like people used to claim in days of old that certain message base formats (BBS / FTN message 'echoes') were faster than others, this is also a bit of rubbish. The format doesn't contain vulnerabilities; the players that implement the format have vulnerabilities. It is, in point of fact, perfectly feasable to assume that the same, if only slightly different vulnerability could possibly be exploited with the Ogg Vorbis format.

          Unchecked buffers (read: lazy/braindead programming and poor code audits) are at fault here. MP3 is merely the current carrier.

          But you're right; it is a feeble excuse to switch formats. It would be more apt to suggest that people switch to a different [musicmatch.com] player [xmms.org], or use a different [apple.com] operating [linux.org] system [freebsd.org], but I'm not going to do that.

  • by sweeney37 (325921) <`moc.liamg' `ta' `yeneewsekim'> on Thursday December 19, 2002 @10:44AM (#4922531) Homepage Journal
    looks like listening to the newest Britney Spears album will result in more than just bad taste.

    Mike
  • by graikor (127470) on Thursday December 19, 2002 @10:46AM (#4922546) Journal
    Why hasn't Microsoft just changed the way it handles buffers to eliminate the weekly discovery of yet another buffer overflow exploit that compromises security? It's obvious to just about everyone else that any buffer that doesn't ignore excessive input will be a problem in the future - why does Microsoft insist on treating each one of these issues as though it was a totally new problem instead of making a global change to secure the OS from this kind of hack?
    • by Anonymous Coward
      because it's a feature !
    • I'm guessing that it require a retest of the entire OS (which isn't a half-bad idea).
      Changing something THAT global could result in more harm than good.

      Mind you, I think you are right, and that's what should be done; I'm just telling you what is (probably) on the architects/lead developers minds.
    • by Frosty Inc. (571723) on Thursday December 19, 2002 @10:55AM (#4922617)
      Because it would cost a lot of money to design and implement, something Microsoft doesn't hav...

      Oh, wait a minute...
    • by Beryllium Sphere(tm) (193358) on Thursday December 19, 2002 @10:56AM (#4922625) Homepage Journal
      This isn't exactly what you're asking about, but to Microsoft's credit they have added a flag to the compiler which adds a "canary" to the stack to detect stack-smashing. Better, the flag is on by default.

      Changing "the way it handles buffers" is harder than it sounds, There's a huge amount of legacy code in shared DLLs, older operating systems and so on.

      If Microsoft asked me to recommend a global change, I'd tell them to go through the agony of implementing least-privilege throughout their entire system architecture. That would be sheer hell, but at least it would contain the damage from whatever next week's security hole turns out to be.
    • by NineNine (235196) on Thursday December 19, 2002 @11:00AM (#4922648)
      I dunno. Why doesn't Linux handle buffer overflows, also? There are always buffer overflow bugs in various apps, like Apache, the PHP mod, etc. Maybe there's no good way of doing it?
    • >> why does Microsoft insist on treating each one of these issues as though it was a totally new problem instead of making a global change to secure the OS

      Palladium

      Oh wait, you don't want that.

      So what do you want?
    • by alispguru (72689) <bane@@@gst...com> on Thursday December 19, 2002 @12:27PM (#4923315) Journal
      Feeding this [google.com] to Google produced 11,000 hits, with over half of the first ten being for commercial or academic systems that claim to detect potential buffer overflow code automatically. I doubt any of them is 100% accurate, but even 50% combined with "shut-up-this-code-is-safe" pragmas would be an improvement over the current situation.

      Buying or installing one of these tools and running all their source code through it as part of development would cost Microsoft less than they spend on caffeinated liquids, and would pay for itself with the first potential exploit caught before shipment.

      I can only ascribe people's refusal to try these tools to programmer hubris - "MY code can't be understood by a mere code analyzer".

      I am rashly assuming here that Microsoft doesn't use tools like this. If anyone out there knows differently, please reply.
  • by tps12 (105590)
    This is more of a curiosity than any sort of danger. Most of us, when we get a new mp3 file, give it a listen to make sure it's not mislabeled, doesn't cut off in the middle of the song, and sounds okay. We throw out or fix the ones that aren't up to our standards. So the number of people who would let one of these dangerous mp3s just sit there and be scanned is probably pretty small. And as is usually the case when something like this is discovered, they probably deserve what they get for being such idiots.
    • From what it says, by then its to late.. As the act of verifying will let the malicious code take effect..

      Unless i TOTALLY misunderstood....
      • by GreenHell (209242) on Thursday December 19, 2002 @11:09AM (#4922706)
        You're exactly right.

        I think what the previous poster is thinking of is ID3v1 tags, which are located at the end of the MP3, so you don't get them until the MP3s finish downloading (and what's more, they have a fixed size so they're easy to check, but that's besides the point)

        Now, this bug involves ID3v2 tags. ID3v2 tags are located at that start of the MP3, which is why when you add one to a MP3 playing in Winamp you get a brief pause, it has to add it to the start of the file. Therefore, any MP3 with an ID3v2 tag will already have the potential of compromising you by the time it's downloaded enough to play part of the song if you preview them using Winamp.

        I don't know how Explorer checks file attributes on MP3s, but I'm assuming that you're already in danger by this time too.
    • by Jucius Maximus (229128) <eg3wjmytaz@NOSpam.snkmail.com> on Thursday December 19, 2002 @10:52AM (#4922599) Homepage Journal
      "This is more of a curiosity than any sort of danger. Most of us, when we get a new mp3 file, give it a listen to make sure it's not mislabeled, doesn't cut off in the middle of the song, and sounds okay. We throw out or fix the ones that aren't up to our standards. So the number of people who would let one of these dangerous mp3s just sit there and be scanned is probably pretty small."

      That average person does not notice when a backdoor app is covertly installed on their machine. As long as the mp3 is actually what they wanted, chances are they will keep sharing it.

      The even more dangerous part is that someone could be downloading mp3s and LOOKING for these trojans. And as soon as they find one, they can just go back to the IP of the machine they got the file from and have an instant DDOS zombie!

      Or even better, if I am an RIAA employed disturber-of-the-peace, I could create a bunch of these trojaned mp3s share them, and then whenever someone downloads it from my machine I could instantly use the backdoor to destroy their music collection. (But I'm sure the RIAA has already thought of that.)

    • by gosand (234100) on Thursday December 19, 2002 @11:00AM (#4922650)
      This is more of a curiosity than any sort of danger. Most of us, when we get a new mp3 file, give it a listen to make sure it's not mislabeled, doesn't cut off in the middle of the song, and sounds okay. We throw out or fix the ones that aren't up to our standards. So the number of people who would let one of these dangerous mp3s just sit there and be scanned is probably pretty small. And as is usually the case when something like this is discovered, they probably deserve what they get for being such idiots.

      I don't think so. I know people who download a lot of stuff, and if you have it set up to download 100 MP3s overnight, your system could be compromised by morning. Are you going to listen to those 100 MP3s first thing in the morning?

      The kicker is that the odds you get compromised go up greatly if someone seeds Kazaa, or even a web page, with an infected MP3 file. They can see who is downloading it so they know the IP to attack. On a web page, they could get your IP out of the logs. I never thought an MP3 file would leave a system vulnerable, but I guess that is why this is a pretty scary vulnerability - nobody else would either.

    • So the number of people who would let one of these dangerous mp3s just sit there and be scanned is probably pretty small.

      Read the Microsoft Bulletin [microsoft.com] (which I got yesterday). Opening a shared directory with one of these MP3s in will trigger the attack, or even previewing an email with one of these attached will execute it.


      Here's MS own words:

      An attacker could seek to exploit this vulnerability by creating

      an .MP3 or .WMA file that contained a corrupt custom attribute
      and then host it on a website, on a network share, or send it via
      an HTML email. If a user were to hover his or her mouse pointer
      over the icon for the file (either on a web page or on the local
      disk), or open the shared folder where the file was stored, the
      vulnerable code would be invoked. An HTML email could cause the
      vulnerable code to be invoked when a user opened or previewed the
      email.
  • by AKnightCowboy (608632) on Thursday December 19, 2002 @10:48AM (#4922568)
    Click the Windows Update button and reboot and you're fixed. Or if you're like many people, the fix has already installed during an automatic update check last night. This isn't really news unless Slashdot is merging with Bugtraq (Slashtraq? Bugdot?). Are we just posting this to bash Microsoft once again? Automatic updates were one of the best new features they added to Windows and they make life much easier. Oh and no, I don't wrap tinfoil around my head worrying whether Microsoft is going to invade my PC and lock me out of it.
    • by Anonymous Coward
      "Are we just posting this to bash Microsoft once again?"


      Yes.

      Sincerely,
      Linus
    • by div_2n (525075) on Thursday December 19, 2002 @11:01AM (#4922658)
      So if NT SP4 had been automatically updating servers and workstations everywhere, that would have been a good thing?

      You couldn't pay me to have my system automatically update itself with patches tested quite possibly only from the company that created it.

      I would rather my system be vulnerable for a day or two than have the contents of my hard drive obliterated.

      What if some patch disabled a computer's networking? What is Ma an Pa gonna do when that is the only computer they have? Download a fix using broken networking?

      IMHO, automatic updating is a monumental disaster waiting to happen.
    • by MacAndrew (463832) on Thursday December 19, 2002 @11:08AM (#4922704) Homepage
      Like another poster I am very wary of updates to anything. Not needing a security patch in the first place is a heckuva lot better than beta testing a hastily written patch for free. Then there are th people who get nailed in the interim.

      Also, on my [platform] I have seen only a few security updates a year on a young OS, some addressing obscure services I don't even use. What's the deal with MS? Why sweep this under the rug?

      I don't buy that automatic bandaids are the answer to hemmoraging code.
    • Conspiracy theorist? (Score:3, Interesting)

      by phorm (591458)
      Winamp doesn't belong to MS, so we're probably just warning people.
      I'm not sure which is worse:
      a) Those that imagine everything MS does is attempt to rule the world
      b) Those that imagine every posting mentioning a bug in MS is a covert attack.

      Considering the amount of geeks here that are into Mp3's, or those that maintain networks (with users who play downloaded Mp3's, permitted or not), this warning sounds like it fits well on slashdot.
    • by Wee (17189)
      Or if you're like many people, the fix has already installed during an automatic update check last night.

      I don't wear the tinfoil hats either, but I find it a little unnerving that people let their system be updated automatically. There's just so many things wrong with that concept. Some updates I don't want, others I defintiely do. All of them I want to see before they get installed so I know what is going to be done. Although I suppose figuring out what an MS update will do can be pretty hard, since they tend to bundle lots of fixes into sinlge packages.

      On the other hand, we're not talking about a dedicated SQL Server machine or anything, so maybe auto updates for desktops isn't a bad idea after all...

      -B

  • Something tells me that my daily virus scan is gonna take a lot longer now...

    Oh wait... it's a Windows problem... never mind...
    RickTheWizKid
    My purpose: to inject random comments...
  • How long before... (Score:3, Interesting)

    by bryhhh (317224) on Thursday December 19, 2002 @10:49AM (#4922571)
    we see a worm exploiting this, remember the last worm [symantec.com] that was executed without even opening a file.
    • This cannot be a self-propagating worm ala Nimda or Code Red. Simply put, it requires user interaction. A user must browse to an infected folder in order for the shellcode to be executed.

      Since a properly administered server is not also a client, it should not be affected, even if a rogue client dumps an infected MP3 onto one of its shares. That is until the admin logs in via TermServ and starts poking around.. but that's still user interaction.

      Hmm.. I wonder. If a person does a search of MP3's, does viewing it in the search window run the exploit? I bet it does..
  • by toupsie (88295) on Thursday December 19, 2002 @10:49AM (#4922572) Homepage
    You guys are all supposed to be using Ogg [vorbis.com] anyways! That way you can act like you are a snooty audiophile anytime a MP3 story is posted...
    • by 13Echo (209846) on Thursday December 19, 2002 @10:56AM (#4922621) Homepage Journal
      Most people don't use Ogg Vorbis for the quality. They use it for the license.

      In high bitrate modes, there is little difference between properly encoded MP3s and OGG files. And high bitrate is what really matters, unless you are streaming over a low bandwidth connection (in which OGG is the clear winner due to size).

      Maybe your comment would make sense if you were referring to something like FLAC from http://flac.sourceforge.net/ . MP3 and OGG are both lossy, so you really can't be a snooty audiophile if you use them. ;)
      • by wowbagger (69688) on Thursday December 19, 2002 @11:35AM (#4922846) Homepage Journal
        Snooty audiophiles won't like FLAC, either.

        A snooty audiophile sneers at any form of digitization - "You aren't getting all of the music - Yes, I know you are sampling a 1GHz, 64 bits per sample, but you aren't getting all the music! Only analog gets all the music! I don't care that what you are missing wouldn't amount to the width of a hydrogen atom on my beloved LP - YOU AREN'T GETTING ALL THE MUSIC"

        That's what a snooty audiophile would say.
  • by Jugalator (259273) on Thursday December 19, 2002 @10:50AM (#4922579) Journal
    From Microsoft:

    An attacker might attempt to exploit this in one of three ways:

    * Host the file on a website. In this case, if a user were browsing the page containing the file and hovered over it with his or her mouse, the vulnerability could be exploited.

    Eep!

    * Host the file on a network share. In this case, if a user browsed to the network share and simply opened the folder which contained the file, it could cause the vulnerability to be exploited.

    Gaah!

    Also, it seems you can send an e-mail with the mp3 object in a frame (this is the third way of exploiting it) so you don't even need to click a link in Outlook / OE for it to be run. This shouldn't be possible on XP SP1 or a recently patched IE though.
    • This shouldn't be possible on XP SP1 or a recently patched IE though.

      Or, of course, Mozilla, Eudora, or Opera.

      Disturbing that it's in WinAmp too. Guess that llama's ass only holds so much.
    • by c0y (169660)
      It can't be denied any longer. Back in the day the poor virus writer had to rely on his victims to carry the payload through meatspace on floppies.

      M$ has been continually improving virus transmission methods, and now you might be infected just by moving your mouse.

      But do we really need to worry? After all, how many kiddies are out there bragging that they '@dm1n1str@t0r3d' someone's XP box. No, it's just not as sexy as r00t3d.
  • would be if they embedded these in Jon Bon Jovi MP3s.
  • by MacAndrew (463832) on Thursday December 19, 2002 @10:55AM (#4922615) Homepage
    Oh, just kidding. :)

    I would like to ask for factually-based opinions whether these innumerable highly dangerous security holes in MS software are more the result of the ingenuity of the hackers or the incompetence of the Microsoft design and testing process, or about 50:50. I am inclined to be prejudiced against Microsoft, so I would be REALLY interested in hearing reasoned defenses of their predicament, if such exist.

    So, please, no MICROSOFT RULZ!!! or MICROSOFT SUX!!! I'm not asking for a vote.

    Microsoft provides the #1 small-system OS, for better or worse, which means Windows will immediately be the hot target for black-hat types intent on spreading misery or demonstrating their hatred for the leviathan.

    I know, too, that half the problem has been MS's arguably foolhardy decisions in adding dubious extensions to their software, like default enabling scripting in Outlook and macros in Word. But I'm kind of curious about the mistakes in doing their core work, like handling MP3's.

    Last, I have trouble understanding how so many of these bugs come from a company with many of the brightest programmers. Is it a largely problem of scale and bureaucracy?

    Share your concise insightful informative nonprofane fact-based reactions from experience? :)
    • by Sloppy (14984) on Thursday December 19, 2002 @12:06PM (#4923129) Homepage Journal
      It has to be a problem of values. Buffer overflows have been biting people in the ass for a long time now, everyone knows they are very serious, and programmers who know what they're doing can easily avoid them.

      If Microsoft is still shipping them, it has to either be because they think it's just not important enough to worry about, or because they don't have the resources to hire decent programmers. The rumors going around indicate that Microsoft has abundant resources.

      Windows will immediately be the hot target for black-hat types intent on spreading misery or demonstrating their hatred for the leviathan.
      For some reason, this has never happened, even though the the opportunity has been there for many years. My guess is that the kind of people who write Worms For Windows, enjoy the fun of it, and know that if they ever write a truly nasty one (massively destructive payload with a time-delay so that it can spread before detonating), there will be a crackdown (either legal or technical) and then the fun will be over. Perhaps that is why Microsoft considers security unimportant: so far there haven't been any serious incidents.
  • You mean they patched both versions and gave them the same number?

    Thanks for nothing Nullsoft.

  • Versions?? (Score:5, Interesting)

    by bconway (63464) on Thursday December 19, 2002 @10:57AM (#4922632) Homepage
    Nullsoft has posted fixed version of WinAmp 2.81 and 3.0 on their web site."

    Is there a reason they haven't released a new version with the bugfix instead of just uploading a new copy with the _same release number and date_? Both versions are listed as released in early or middle August, and there's no bugfixes listed anywhere on the site in regards to this. Site [winamp.com]. Are they trying to hide that it's been fixed, or just don't want anyone to figure it out?
  • by TerryAtWork (598364) <research@aceretail.com> on Thursday December 19, 2002 @11:04AM (#4922675)
    I was sent and installed the fix before I read about the vulnerability.

  • Explorer workaround (Score:4, Informative)

    by stratjakt (596332) on Thursday December 19, 2002 @11:04AM (#4922677) Journal
    Tools->Folder Options

    set Web View to "Use Windows Classic Folders"

    I've always done this, having never trusted 'web content' in any folder I browse to (nor needing the extra overhead it causes drawing thumbnails of bitmaps and whatnot)

    I believe any Windows that's upgraded to Media Player 7.1 and/or IE6 would be vulnerable, not just XP?
  • Long ago, I've decided that Windows 2000 was going to be my last mainline MS operating system. Since Linux is making great strides towards usability on the desktop, it looks like I'll never have to rely on having XP on my PC. Now, I just have to make sure I keep Winamp current along with all my other applications.

    However, this brings up an interesting question. Short of modifying the registry entries in HKEY_CLASSES_ROOT, is there any way to avoid all the cutsie stuff MS has been doing with file associations? I seem to remember a Win95/NT/2k shell extension that did something similar to the MS code that's being exploited. It popped up an additional property sheet with all the ID3 tag info. Could someone use that instead of the Windows shell without severely hacking the registry?

    It also reopens an old sore. If the Windows Media Player were installed as an "application," not as "part of the operating system," this shell code would not be needed until WMP is installed. Those smart enough to search for better media-playback solutions would not be subjected to this vulnerability. Thanks, Microsoft! DOJ, are you paying attention?

    And one more observation: now that MP3 files can carry shellcode, the virus scanners will have to start scanning them too. More processor overhead, longer scantimes, moan, gripe, ...
  • Thanks to Boatboy for the explanation of buffer overflows [techtarget.com], but what I've never understood about buffer overflows is how it allows you to execute arbitrary code? Can anyone explain?
    • by Anonymous Coward
      Search the Web for the classic: Smashing the Stack for Fun and Profit.

      All you ever wanted to know, and then some...
    • by pclminion (145572) on Thursday December 19, 2002 @11:32AM (#4922828)
      Because of the way data is stored in memory. It is common in C code to declare buffers as local variables, causing them to be allocated from the stack. The stack, as it happens, is also used for execution control.

      By overflowing a buffer on the stack, it's possible to maliciously change a particular piece of information (the function call return address) to cause the program to jump to a new piece of code: the code you just overflowed the buffer with!

      Stack overflow exploits are very common because programmers often declare fixed-length buffers as stack variables and are too lazy to perform proper checking to make sure data never overflows the buffer. This problem in WinAmp is no different than any other buffer overflow, it's just much more severe due to its widespread use.

  • will now the MPAA and RIAA have a new weapon against pirates?
    And if they do, executing remote code using a vulnerability will be legal? :)

    [just provoking]
  • The Next Nimda. (Score:4, Interesting)

    by Deathlizard (115856) on Thursday December 19, 2002 @11:22AM (#4922788) Homepage Journal
    And I thought Nimda was bad.

    When all of the college students here on campus had read/write shares on the network, Nimda Spread at an alarming rate, Especially since WinXP Home decided that you SHOULD have your Shared Documents folder open for read/write access after running one of those networking wizards.

    I could only imagine the hell a Modified Nimda would be if it can now infect mp3 files. It wouldn't even have to spread infected .eml files anymore. you would just see a new MP3 in your read/write network share with thousands of other MP3's so you would never find it and it would infect all of your MP3's in your read/write network share. Once you open the folder to pick a song it runs and infects all of your mp3's on the PC, then goes out and proceeds to infect every mp3 it can write to on the network that has read/write shares and the process starts all over again while it formats your hard drive 7 days later.

    It's the RIAA Dream come true :P
  • by wowbagger (69688) on Thursday December 19, 2002 @11:25AM (#4922808) Homepage Journal
    There's a running joke where I work that it is not officially Thursday until the Microsoft exploit of the week is released (of late this seems to happen on Thursday).

    So, why not make it official - I propose

    Operation: So Happy It's Thursday

    What I recommend is that everybody who finds an exploit in Windows release it on Thursday.

    NOTE: be fair - a bug in a Windows APP that is not a part of Windows doesn't count - so the bug in Winamp doesn't count, but the bug in the Windows shell does.

  • by jmcnamera (519408) on Thursday December 19, 2002 @11:33AM (#4922835) Homepage
    It's good that I have linux since it **never** has buffer overflows. Nor does any other open source software.
    • It's good that I have linux since it **never** has buffer overflows. Nor does any other open source software.

      I hate postings like this, because I never know whether I should mod it +1 Funny or -1 Clueless.

  • foobar2000 (Score:4, Informative)

    by slothdog (3329) <<moc.liamg> <ta> <godhtols>> on Thursday December 19, 2002 @11:37AM (#4922865) Homepage
    Apparently the current underground favorite audio player for Windows is foobar2000 [saunalahti.fi], which was written by a former Nullsoft developer (Peter P. aka zZzZzZz). It supports mp3, ogg, ape, flac, mpc, and relevant to the article has abandoned ID3V2 support in favor of APEV2 tags. (And it's been suggested that the source will be released in the near future.) Supposedly the audiophile geeks at hydrogenaudio.org [hydrogenaudio.org] can hear quality improvements over Winamp, although even the developer suggests that it's probably a placebo effect.

    Just don't expect too much; it's a very minimalist GUI (what mean these "skinz" of which you speak?), and doesn't support Win9x/NT4.

    There's also a support forum [hydrogenaudio.org] for the player.
    • New URL (Score:3, Informative)

      by Compact Dick (518888)

      Foobar2000 has a new homepage [hydrogenaudio.org]. Version 0.3 has also been released.

      For those wondering what to expect, foobar2000 has a minimalist interface, but it does the job. CPU usage is very frugal and your MP3s can sound noticeably better. Why? Because clipping prevention is built-in, removing any distortion induced by overly loud signals.

      I am currently running 0.3, and it's a beautiful piece of work. If you want a multi-format player that runs unobtrusively in the background while you do your other stuff, then foobar2000 is for you. At 168 KB, it's worth trying out.
  • by hoggoth (414195) on Thursday December 19, 2002 @11:38AM (#4922872) Journal
    OK class, has anyone figured this out yet?
    Buffer overflows are bad.

    It is easy to STOP buffer overflows just by using SAFE strcpy functions that don't blindly copy past the end of a buffer.
    Since we've known this for many many years, why do programmers still USE dumb functions that allow buffer overflows?!

    Hey Microsoft, since you are spending so much on improving security, I have a hint for you. Print this out and make all your programmers pin it on their cubicles walls:

    BAD: strcpy
    GOOD: strncpy

    • by nestler (201193) on Thursday December 19, 2002 @12:06PM (#4923126)
      99% of people using strncpy don't actually bother to read the definition of what it actually does.

      Hint, this code is buggy:
      char buf[1024];
      strncpy(buf, big_ass_string, sizeof buf);

      strncpy doesn't bother adding a null-terminator in the case where big_ass_string is too big. Most people don't realize that they have to do all of this to be safe with strncpy:
      strncpy(buf, big_ass_string, sizeof buf - 1);
      buf[sizeof buf - 1] = '\0';

      The real solution is to use a function that doesn't have such crappy behavior: strlcpy

      strlcpy(buf, big_ass_string, sizeof buf);

      It always does null-termination. You never have to lie to it about the size of your string. Same goes for strncat (bad) and strlcat (good). Thank the OpenBSD developers for these. They are very useful in avoiding overflows when you don't have the option of using C++ and the string class.

  • by tbmaddux (145207) on Thursday December 19, 2002 @11:41AM (#4922913) Homepage Journal
    No mention of iTunes anywhere. Am I vulnerable? What about my iPod? Were they tested as well? Couldn't find any mention at the links provided and no test mp3s to try out.

    Give me full disclosure...

  • by teamhasnoi (554944) <teamhasnoi@NOspam.yahoo.com> on Thursday December 19, 2002 @11:42AM (#4922915) Homepage Journal
    10 Print "Windows Luser! You will Pay for Your Insolence!"
    20 Print "Bill Gates laughs as he rolls about with his concubines!"
    30 Print "Prepare for judgement!"
    40 Input "Press any key";A$
    50 If A$="AnyKey" Then fucksomeshitup;
    60 W00t: Poke InChest;
    70 Run "BSOD.exe -Playfile BritneySpears,HitMeOneMoreTime"
    80 Print "This is what it sounds like when doves cry! Bwahaha!"
    90 Goto 10

    You should be able to find this on SourceForge too.

  • by haplo21112 (184264) <(haplo) (at) (epithna.com)> on Thursday December 19, 2002 @11:42AM (#4922921) Homepage
    I don't mean to be a pain in the ass here...but if the code has been patched and rebuilt on a different day shouldn't we at least see a different minor version in the help? I can understand fine at 488 is the code freeze version for the 3.0 release however is a bug has been patched and a new release has been done should this be like 3.01(3.0.1) or 488a just so the its more immediately obvious this is an updated version from the 3.0 I have. If I didn't know about the bug, and I went to the site to see if there is a newer version, I wouldn't get the fixed version cause I still see 3.0! Build dates are meaningless...and even less so if they are not even posted on the download page....
  • CDDB (Score:3, Interesting)

    by laigle (614390) on Thursday December 19, 2002 @11:53AM (#4923024)
    The twitchy part is, even most people who rip their own music these days get the ID tags via some free database site, and those often take submissions. How hard would it be for somebody to just submit a bunch of malicious ID tags for popular albums?
  • by Raul654 (453029) on Thursday December 19, 2002 @12:10PM (#4923165) Homepage
    My advisor, DL Mills [udel.edu] (the guy who invented NTP), said something a while back which this article somewhat reminds me of. He said that back in the day, people wrote operating systems in assembly. But the thing is, they just got way too f****** big and couldn't be maintained, even with the best of care. He said that today's operating systems are getting to that point as well, and maybe it's time for a new level of abstraction. Stuff like exception handling (amoung which automated buffer checking should be one), garbage collection, etc, should be built into the language, and leave the programmer to concentrate on more important things.

    So my question is, does anyone have any idea what this "new level of abstraction" might be?
    • by frank_adrian314159 (469671) on Thursday December 19, 2002 @03:16PM (#4924785) Homepage
      does anyone have any idea what this "new level of abstraction" might be?

      Lisp.

      There's even been an OS built in the language. Seemed to work just fine. Problem was, that in those days, you needed special purpose hardware to run a Lisp-based OS on. You don't anymore, but the code has been lost to people who could do something useful with it in the mist of time and bankruptcy. Google for Genera and OpenGenera. Hint - once the base code is built into the system, you cannot have buffer overflows, uncaught exceptions, or uncaught arithmetic overflows. It's a good environment (as I can attest, having it running on my Symbolics Lisp Machine at home).

      Oh yeah, they have a great OO database, decent graphics, and all of the web crap you'll ever need, too.

  • by irregular_hero (444800) on Thursday December 19, 2002 @01:00PM (#4923623)
    A long time ago, you could destroy your files and have a very bad day by using that floppy from your friend that had creeping crud on it.

    Shortly thereafter, your files were potentially at risk from files that you spent all day downloading from a BBS. Fairly soon after that, a malicious file could sneak onto your hard drive and cause mischief once FTPed from the Internet at a bit higher of a rate. In each case, you pretty much had to type the name of the file to run it.

    Enter the world of Windows. Now running the file gets a hell of a lot easier, just a few points and clicks. And obtaining those lovely infected files gets a lot easier with the faster Internet connections and new "killer apps" like Usenet, e-mail, and the World Wide Web gaining in popularity. In less than a year, these files gain literally thousands of new vectors.

    Then it becomes possible to pick up an infection by receiving a file via e-mail inside a program that loves to muck about with files before you run them by, er... running them. The only user interaction required is hitting the "send/recieve" button.

    After that, malicious files no longer need to be files. They can be specially formatted e-mails, and all you need to do is preview them -- you don't even have to read them -- in order to get smacked by the latest nasty bug.

    Don't feel e-mail is safe? Well, it wouldn't matter if you stopped using it entirely, the creeping crud will still get in if you click on a link on the Web. And as if the front door didn't put up a paper-thin defense, the back door will allow malware to slip in via Web server software, file shares, file transfer servers, and even instant messaging.

    Now what do we have?

    A malicious file you only have to point at for a moment to get an infection.

    You've come a long way, baby.

A slow pup is a lazy dog. -- Willard Espy, "An Almanac of Words at Play"

Working...