Winamp 5.12 0-day

Winamp has just released their 5.12 version last December 9, 2005, and now a new exploit for the new version is out. FR-SIRT already released and advisory(as well as the PoC) and yes, it works. As described in the attack vector: “make a html page containing an iframe linking to the .pls file.”


The author also released a link to a site which utilized the iframe, and here are some notes:



  • On visiting the link via FireFox, a dialog box asks you whether you want to download, or open the file.
  • On IE, however, the PoC is automatically executed without any warning.

I therefore conclude, if you have the vulnerable version of Winamp (and no patched version yet), use FireFox when browsing the web. No reports of this ITW yet.