The zero-day exploit, revealed earlier this week, allows remote code execution through the use of a crafted playlist, or .pls, file.
"The proof-of-concept exploit suggests using an iframe to trigger a 'drive-by' attack on anyone unlucky enough to visit a website containing a malicious iframe; say, third-party advertisers and forum websites – the usual vectors for this sort of thing," Ed Skoudis of the SANS Internet Storm Center said this week.
Nullsoft, Winamp's maker, released a new version – 5.13 - of its product on Monday, and urged users to download the updated software, which does not contain the vulnerability.
Secunia, which classified the flaw as "extremely critical," said ATmaCA reported the flaw and also recommended users update to version 5.13.
"The vulnerability is caused due to a boundary error during the handling of filenames including a computer name," Secunia warned. "This can be exploited to cause a bugger overflow via a specially crafter playlist containing a filename starting with an overly long computer name (about 1040 bytes). Successful exploitation has been confirmed in version 5.12. Other versions may also be affected."
