Winamp security flaw

[Greebe]

NGSSoftware is reporting a flaw in the way the popular Nullsoft Winamp loads certain metafiles could be exploited by an attacker to overwrite heap memory. By exploiting the flaw, the attacker could run arbitrary code on the affected machine. A fix is available in Winamp 5.05

http://www.nextgenss.com/advisories/winampheap.txt

appears to be something of a IE security zone flaw of some such, nobody knows for sure quite yet...

Here's a link from Winamp's forums on the subject...

http://forums.winamp.com/showthread.php?s=&threadid=190902

[Kooldino]

I assume this doesn't effect Winamp 2?

[az]

You're right, KD. Doesn't even affect Winamp 5 and a proper browser

AZ

[William]

This is a Winamp problem rather than an IE one -see http://secunia.com/advisories/12381

They only mention 3.x & 5.x -when did winamp add skinning? With IE it can be exploited remotely. With Opera/Firefox it needs a user to attempt to install the skin.