Winamp Skin Exploit in the Wild 397
An anonymous reader writes "Secunia.com has announced an exploit (derived from xml escaping the Internet zone into IE's local zone) that exploits Winamp's habit of automatically installing skins. Currently all versions of Winamp are affected. Details on the Winamp forums - apparently an exploit is already in the wild, and spreading."
Am I the only one... (Score:5, Interesting)
i hate skins (Score:2, Interesting)
Redmond school of engineering (Score:5, Interesting)
Expect these to grow more common... (Score:5, Interesting)
Now that people have started to use firewalls, and the risk of worms and rootkits that infect through open, exploitable, holes grows smaller, it is time to expect more and more exploits to follow alternative vectors.
Note how many buffer-overflow exploits there have been in server daemons. Well, there is no reason to believe that servers are any worse written with regards to input than client applications - quite the contrary actually.
People think they are safe with a firewall. But I'm willing to bet there are undiscovered exploits in just about every application they run. WinZip? WinAMP? Acrobat Reader? Media player? Anything that handles files received over the Internet is potentially a vector for viruses and possibly worms.
This time it was bad escaping, which made the exploit trivial, but there a buffer overflow would have served just as well. Neither firewalls nor anti-virus software will protect you.
Dumb Question (Score:5, Interesting)
For what possible purpose does a skin -- which is essentially nothing more than graphical elements -- need to invoke the browser?
WTF? Seriously, help me out here. I've only been a programmer for 25 years, so I may not understand the deeply compelling reasons driving such a design decision.
Schwab
Re:i hate skins (Score:3, Interesting)
Ever changing interfaces would indeed be an annoyance, but the point of skins is to let you find the UI you like and stick with it. For any individual user the UI is the same (unless you really want to keep changing it) its just that different users can have different UIs.
Its a bit like the "bloat" in large applications like Word. Of course most users only use 10-20% of Word's features, but each person can use a subtly different 10-20%. You choose to learn the subset of features that are useful to you and ignore the rest. Those others are only a minor distraction.
Re:i hate skins (Score:4, Interesting)
I don't go with random skins, or frequently changing skins. I just browse the library, pick a good one, and stick with it.
Re:Simple solutions (Score:3, Interesting)
might want to release that patch... (Score:1, Interesting)
Dumb Answer (Score:3, Interesting)
*raises hand*
Because since the late 90s EVERY PROGRAM must use the internet in some way. Useful or not. Anyone else notice this trend?
back to media player.. (Score:3, Interesting)
"Cant trust those evil 3rd party hacker programs... Thats what they say they wouldnt lie.. See this just proves it.."
Not that Microsoft would be *that* evil to release exploits for 3rd party apps.... but its an idea..
Winamp's or IE's fault? (Score:4, Interesting)
This isn't the first app that gets nailed just because it was using IE (for whatever extent of use - full rendering or peripheral stuff like SSL Certificate handling or XML processing).
Just add this to the IE screwups tally
get a free iPod! [freeipods.com][This really works! - I have only 3 more referrals to go, my buddy already got his iPod (I should have gotten into this earlier
i'm famous! (Score:3, Interesting)
Just to add to the original thread a little, I only saw the worm spreading on IRC and I only saw 2 people who were spamming the link - like all mirc worms the infected person doesn't know they are doing it until someone tells them.
I guess it's not got very far - since I reported the exploit i've not seen another spammed link for it.
Re:The exploit: (Score:2, Interesting)
When did this become a common problem? When I used to program way back in the late 80's software code was simple and clean. We didn't really have issues like this to worry about. The occasional virus, but those were actually .com or .exe programs. I know the Internet wasn't in place for the public yet, but still. And I know about the Unix worm. But isn't the main reason this is happening because coding gotten either that sloppy or that disorganized?
As much as I hate Microsoft, I don't blame them for things like this although they have not set a good example. There are thousands of programmers to blame for sloppy code, bloat and security issues so we can spread it around a bit.
Re:yet another way... (Score:1, Interesting)
WTF else!
Re:Further evidence that skinning is stupid (Score:2, Interesting)
ALso, the whole point of computers is to allow flexibility and the ability to customize the tool to fit our hand.
I do, though, draw the line at methods of skinning that end up being security risks... I am not sure that skins that have executable parts are a good thing...
Suggestion to Windows yet NON-IE users (Score:3, Interesting)
Re:say it out loud... (Score:2, Interesting)
Re:Mozilla (Score:2, Interesting)
How difficult (and guessing it's feasible, this is probably in the works) would it be to build with Mozilla an emulation of IE's embed? In other words, will there come a day when one could force a Mozilla embed by overriding the IE version?
Re:say it out loud... (Score:1, Interesting)
Of course there is, in fact with greater granularity than Unix permissions allow. The problem is, if you blanket deny write access to anything but the user's directories, many programs break.
Too much stuff is written by programmers who think that writing to the application directory is ok. It's easy enough to enable write permission to individual files to get around this (and registrey keys in some cases), but doing it for about half of the installed programs gets old really quick. And that's after you determine which files/keys they need write permission to.
So if you're not a Windows expert and don't have one around, practically speaking it's impossible.