Winamp

On the 15^th of October, the BitDefender® labs came across four critical vulnerabilities affecting Winamp® 5.x. Shortly thereafter, several exploits piggybacking on these vulnerabilities were spotted in the wild. We won’t go into detail about the first three, as they basically need no user interaction beyond loading them into the playlist, so here’s a short run of the fourth one.

The “weapon” used by the cyber-criminals is a malformed MTM file – an audio file format similar to the MOD and MIDI file – distributed to different potential victims as e-mail attachments, or through social networking or peer-to-peer file sharing. Its purpose is to lure computer users into downloading and adding it to their playlist. 

However from this point on, a little bit of social engineering is in demand since, in order for the exploit to trigger its payload, it is mandatory for the user to view the file info in Winamp. This is the action that sets the exploit contained inside the malformed MTM file into motion.

Long story short, as soon as the user views the file information, the exploit will initialize a backdoor service running on port 4444 and it will be ready to take connections from the outer world. The backdoor will be consequently used by an ill-intentioned person to easily gain remote access to your computer with the same privileges as the user running Winamp. 

Here’s a short video demonstrating how a connection becomes possible on port 4444 after the user has viewed the file info.

BitDefender detects the malformed file as Exploit.Winamp.D and will terminate it before the user is able to load it in the player. In order to stay safe from this type of exploits, you are advised to download files from trustworthy repositories only and never perform any actions on the computer if they have been requested or suggested by persons you do not know or trust.

The technical information in this article is available courtesy of Răzvan Benchea, BitDefender Malware Analyst.

All product and company names mentioned herein are for identification purposes only and are the property of, and may be trademarks of their respective owners.