Specially prepared skins inject malicious code into XMMS media player
Manipulated skins for the XMMS Open Source media player reportedly allow malicious code to be injected into a system and launched with the user's rights. According to security service provider Secunia, two flaws in the routine that processes skins can allow certain skins to cause an integer underflow and an integer overflow. As a result, arbitrary code can be written into memory. However, victims still have to download the malicious skin, select it with the skin browser, and load it for the attack to succeed.
The flaw was found in the current version 1.2.10 of XMMS, but previous versions are probably also affected. No patch has been made available even though Secunia informed the Linux distributors of the problem back on February 6. The service provider therefore suggests a workaround: do not install any skins from untrustworthy sources.
- XMMS Integer Overflow and Underflow Vulnerabilities, Security advisory from Secunia
(ehe)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/6/7/2/comingin310_4_kicker-4977194bfb0de0d7.png)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/3/2/3/comingin310_3_kicker-151cd7b9e9660f05.png)
