A vulnerability has been reported in WinAMP, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a boundary error in the MIDI plug-in "IN_MIDI.DLL" when handling MIDI files. This can be exploited by constructing a MIDI file with a "Track data size" value of "0xFFFFFFFF" and tricking a user into playing it.

The vulnerability has been reported in version 2.91 (includes version 3.01 of the MIDI plug-in). WinAMP 3 is partly affected but exploitation only causes it to crash.

Solution
Update to WinAMP 3 or use another product.
Further details available to Secunia VIM customers

Provided and/or discovered by
Luigi Auriemma

Original Advisory
http://aluigi.altervista.org/adv/winamp-midi-adv.txt

Deep Links
Links available to Secunia VIM customers