Winamp Zero-Day Exploit

Hello,

I just saw the following advisory on SANS

Quote:

---

While we're on the topic of audio software, there's a 0-day exploit out today for Winamp 5.12 that allows remote code execution via a crafted playlist (.pls) file. The proof-of-concept exploit suggests using an iframe to trigger a 'drive-by' attack on anyone unlucky enough to visit a website containing a malicious iframe; say, third-party advertisers and forum websites--the usual vectors for this sort of thing.
Secunia's got a nice writeup of it here.

---

Secunia has it as an Extremely Critical vulnerability.

Just a heads up! Watch yourselves!

-Deeboe

Thank you for the warning!

And, the WinAmp update is available. See the web site above.

;)

Sorry about the double post, but Ed at ISC says:

Quote:

---

Update Jan 31: There's a sploit in the wild for this one. Have you patched yet? The kiddies will come a-callin' soon. --Ed.

---

Check it out at: http://isc.sans.org/

Git 'er done!