Running Winamp? Don’t Play Any Strange Playlists

By Jimmy Daniels
Contributing Writer, RealTechNews

On Monday Nullsoft announced that version 5.12 had a security bug and released a patch to fix it. Exploit code is already circulating the internet, a rep from Sunbelt Software said they have already found websites hosting a winamp play list that took advantage of the exploit to load spyware on their computer.

“After surfing to a malicious Web site on our test machines, the file ‘x.pls’ begins to download,” Sunbelt’s Adam Thomas wrote in a posting on the anti-spyware software maker’s corporate blog. “Almost immediately, Winamp starts to execute the play list and remote code execution begins.”

The flaw was disclosed on Monday, when Winamp maker Nullsoft, a division of America Online, released an update to fix it. The company posted version 5.13 of Winamp, while Secunia and other security companies issued alerts about the problem. Secunia rated the issue “extremely critical,” its highest rating.

“Not following the recommendation from Nullsoft to upgrade to version 5.13 could result in the extremely nasty CWS Looking-For.Home Search Assistant infection as well as an installation of our good friend SpySheriff,” Thomas wrote. Antivirus software is not yet detecting this exploit, he wrote.

We Say: Download the latest version here if you use Winamp and save yourself some trouble. SpySherriff is definitely a pain to remove, my boys pc got hit with it from the windows meta file exploit, changed his background, flashed this warning every minute or so. I hated them in less than a minute, a new record. At least the website Sunbelt found was no longer available as of this writing.