Secunia

Secunia Research has discovered a vulnerability in jetAudio, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a boundary error when creating the "tooltip" display string using ID Tag information retrieved from an audio file (e.g. WMA). This can be exploited to cause a stack-based buffer overflow via a specially crafted WMA file with overly long ID Tag values (e.g. "Title", "Author", or "Album").

Successful exploitation allows execution of arbitrary code, but requires that the malicious file is opened when the sound card driver is disabled or not properly installed.

The vulnerability has been confirmed in version 6.2.6.8330 (Basic). Other versions may also be affected.

Solution
Ensure that the sound card is properly installed before playing untrusted files.

Provided and/or discovered by
Tan Chew Keong, Secunia Research.

Original Advisory
Secunia Research:
http://secunia.com/secunia_research/2006-45/

Deep Links
Links available in Customer Area