Microsoft’s Windows XP and the WinAmp MP3 player are both vulnerable to a buffer overrun vulnerability that could cause code to be run on a target computer, a security firm said Thursday.
The vulnerability, which Microsoft describes as “critical”, is described on this page. A fix is here.
The vulnerability exists within the Windows Shell, which serves as the basis for the Windows desktop. The security hole exists within identifying information used within MP3 or WMA files. Even moving the mouse pointer over such a file on either a Web site or in an email causes the file’s header to be read, and the code executed, Microsoft said.
Fortunately, only the Windows XP operating system is vulnerable, Microsoft said; all previous versions of Microsoft operating systems remain unaffected. In addition, Microsoft said mousing over an affected file within Outlook or Outlook Express should not produce any adverse effects if the XP Service Pack 1 has been applied. Clicking on an HTML link to an affected file will still trigger the buffer overrun.
A related vulnerability exists within the popular WinAmp MP3 media player, according to Foundstone Research Labs, which discovered both vulnerabilities. In this case, overruns associated with the ID3v2 tags could allow an attacker to remotely run code on a machine. Both the WinAmp 2.81 and WinAmp 3,0 versions are affected, albeit with derivatives of the same vulnerability.
“If an MP3 is loaded into Winamp 3.0 that has an ID3v2 tag, the Artist
and Album fields of the ID3v2 tag are displayed within the Media
Library window of Winamp3,” Foundstone said. “An attacker could create a malicious MP3 file, that if loaded via the Media Library window, would compromise the system and allow for remote code execution.
“An attacker could create a malicious MP3 file that exploits either the
overflow of the Artist ID3v2 tag or the Album ID3v2 tag (or both),” the advisory continued. “For either overflow to occur, the user has to attempt to load the MP3 file from the Media Library by at least single clicking on either the MP3 via the Artist or Album window.”
Foundstone said they recommended users download and reinstall whatever version of WinAmp they currently have, whether it be version 2.81 or the latest 3.0 upgrade.
Copyright © Olli Parviainen 2000-2003
Visit the PaceMaker home page for more information & updates : http://www.surina.net/pacemaker
1. Introduction
OldVersion.com Points System. When you upload software to oldversion.com you get rewarded by points. For every field that is filled out correctly, points will be rewarded, some fields are optional but the more you provide the more you will get rewarded! Winamp 2 is an old version of the popular Winamp and it is still installed on many Windows workstations out there, although some would argue that it looks like a waste of time because it lacks a.
PaceMaker is a component (plug-in) for Winamp3 player, enabling controlling the sound tempo, pitch and playback rate independetly from each other. That is, with PaceMaker it's possible to:
- Speed up or slow down the music tempo without affecting the music key (pitch)
- Change the music key (pitch) without affecting the tempo
- Change the music playback rate as if a vinyl record was played at a higher or lower rate than rated
The 'alpha' version means that this is a test release with still incomplete set of features. Please read a notice about future plans.
2. System requirements
- PC with a 233 Mhz CPU or faster (see the troubleshooting section if you have too slow PC).
- Winamp player v3.0 or later. The Winamp player can be downloaded for free at www.winamp.com . Please notice that this version of PaceMaker isn't compatible with Winamp v2.x player; there's however another version of PaceMaker for Winamp v2.x that's available at the PaceMaker home page.
- Windows 95, 98, NT 4.0, 2000, XP or compatible
3. Activation & Uninstallation
- To enable PaceMaker, click the 'PM' icon on Winamp3 'Thinger' window (see picture beside). The PaceMaker window should now appear on your desktop.
- If the 'Thinger' window isn't visible, click the Nullsoft logo at corner of the Winamp3 window to show the Thinger.
- To close the PaceMaker window, either click the close icon at corner of the PaceMaker window title bar or click again the 'PM' icon on Winamp Thinger.
- To permanently uninstall PaceMaker from your computer, locate the file 'pacemaker.wac' at your Program FilesWinamp3Wacs directory and delete it.
4. PaceMaker control window
- Control the Tempo, Pitch & Playback Rate settings by moving the sliders or pushing the -/+ buttons at the right-hand side of the sliders.
- Adjustment ranges are currently -50%..+100% for Tempo & Playback Rate and -12 .. +12 half-steps for Pitch (i.e. semitones, 1/12th of an octave).
- Pushing the 'Disable' or 'Enable button will temporarily disable/enable PaceMaker sound tweaking effects.
- Pushing the 'Reset' button resets the controls to zero settings.
- Pushing the 'Help' button displays help file (this page).
Usage tips
The sliders can be fine-adjusted with the mouse wheel or keyboard, just activate the desired slider first by clicking it (or its label) with a mouse button or use the 'tab' key to switch between the sliders. The currently active slider is indicated with green color.
- The Mouse wheel adjusts the active slider in small steps.
- The arrow keys on the keyboard adjust the active slider in small steps.
- The Page Up/Down keys adjust the active slider in larger steps.
- The Home key resets the current slider to center position.
5. Known issues
Winamp 2.81
- There's a delay of a couple of seconds before the music reacts to changes made in PaceMaker control window : There are basically two causes for the problem:
- Winamp3 cross-fader causes a delay of several seconds. To eliminate this delay, disable the cross-fading by clicking the button with an 'X' symbol on Winamp3 main window.
- Winamp buffers sound data for a couple of seconds to prevent skips under heavy system load. If you find the delay annoying, go to Winamp3 preferences and reduce the 'Buffer Size' setting in audio/DirectSound configuration page.
- Winamp3 crashes when changing Winamp skin if PaceMaker window has been active. This appears to be a bug in Winamp v3.0. Nullsoft may fix it some day, but at the meantime the issue can be circumvented by using the following procedure when changing skins:
- Close PaceMaker window
- Restart Winamp3
- Change skin
- Open PaceMaker window
6. Troubleshooting & FAQ
Is there an expiration time limit in PaceMaker3?
Winamp 2.81 Skins
No, this version doesn't have a time limit. There was an expiration date in the first alpha release of PaceMaker3, but it was removed because it's likely that this is also the last version of PaceMaker3 component for Winamp3 for the time being due to suspending of Winamp3 player development work by Nullsoft.
PaceMaker doesn't work with audio CD's played in my CD-ROM station.
PaceMaker processes the sound data that Winamp3 passes through it. If PaceMaker doesn't affect your audio CD's, ensure that 'Enable CD audio extraction' is checked in 'Audio CD Settings' page of Winamp preferences. If this doesn't help, it may also be that your CD-ROM drive can't extract audio data in binary format.
The music has breaks / My PC is too slow
Winamp3 requires quite a lot more CPU muscles than the good old Winamp2. If you have an older PC with say 150..300Mhz processor, you might be better off with the older Winamp version. You'll find Winamp 2.81 at classic.winamp.com and PaceMaker for that version at the PaceMaker page.
Is it possible to use PaceMaker routines in own applications / Is there a command-line tool for processing audio files in batch mode
Yes it is; Please contact the author if you'd wish to receive the source codes or otherwise have more information.
Please notice that I've released an open-source library having similar DSP routines than PaceMaker that can be used for doing sound processing in own applications. See the SoundTouch page for source codes and more details.
There have been queries on how the PaceMaker's DSP algorithms work; I've planned to write a description of the algorithms for quite some time, but have so far been too busy to compelete that. Will do so some day, hopefully...
7. Planned work
Notice concerning Winamp3 future: Nullsoft (the group developing Winamp) has obviously suspended Winamp3 development project. Unless Winamp3 development will be resumed, it's infeasible to continue developing PaceMaker component for a dying player platform, and in this light this will be the last PaceMaker component release for Winamp3 player for the time being. Future work among PaceMaker will concentrate around Winamp2 or some other actively developed player platform.
Original plans for the PaceMaker3 improvements included:
Winamp 2.81 Full
- Storing current slider settings at exit or for each song if so desired
- GUI improvements (windowshade mode, distinct steps in slider movement, accept long clicks on +/- buttons)
- Configurable slider scales, precisions
- Support for 8bit audio
8. License & Warranty
The PaceMaker is provided 'as is' without any external support or warranty. This software can be used and further distributed for non-commercial purposes. When distributing the software, all files in the original installation package have to be included and kept unchanged. The software can be distributed as a part of a program collection or a publication, as far as no other payment is demanded except for reasonable delivery costs.
Use of PaceMaker plug-in module or the source code as a part of a commercial product without author's permission are prohibited. Please contact author for further details.
The author won't take any responsibility for mental or social problems the software may cause.
9. Contact information
Check for updates at the product home page http://www.surina.net/pacemaker.
The author can be contacted at <oparviai @ iki.fi>. When reporting bugs or missing features, please notice the above comment about the Winamp3 player future.
This document has been updated on 07-Sep-2003
Winamp 2.81 Download