Check Point Advisories

Nullsoft WinAmp Ultravox ultravox-max-msg Header Buffer Overflow (CVE-2006-5567)

Vulnerability
Protection

Check Point Reference:	CPAI-2006-271
Date Published:	15 Dec 2009
Severity:	High
Last Updated:	Tuesday 15 December, 2009
Source:
Industry Reference:	CVE-2006-5567
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?
Vulnerability Description	NullSoft Winamp is a multimedia player that is capable of playing many formats of audio and video files and streaming protocols. Winamp supports the Ultravox media streaming format, a proprietary streaming media protocol developed by AOL. Ultravox or Ultravox Media On Demand Server (UltraMODS) is designed as a multiplatform media streaming format which is similar to the media streaming protocol SHOUTcast, which was originally designed by NullSoft. The goal of Ultravox is to provide improved Internet routing and facilitate handling of more users. A buffer overflow vulnerability exists in the Nullsoft Winamp multimedia player. The flaw manifests itself during the processing of crafted Ultravox protocol responses. Exploitation of this vulnerability may allow an attacker to inject and execute arbitrary code on the target host. Upon processing of the response headers, the client application may exhibit two distinct behaviours. If a code injection attack attempt is performed and is unsuccessful, the client application will terminate. If such an attack attempt is carried out successfully, the behaviour of the client application as well as the target host is dependent on the intention of the injected code. The injected code is executed with privileges of the currently logged on user.

Protection Overview

This protection will detect and block attempts to exploit this vulnerability

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

In the IPS tab, click Protections and find the Nullsoft WinAmp Ultravox ultravox-max-msg Header Buffer Overflow protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: Media Player Enforcement Violation.
Attack Information: Nullsoft WinAmp Ultravox ultravox-max-msg header buffer overflow