CVE-2008-3441

Nullsoft Winamp before 5.24 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.

• CWE-94

• http://archives.neohapsis.com/archives/bugtraq/2008-07/0250.htmlBroken Link
• http://securitytracker.com/id?1020582Third Party Advisory, VDB Entry
• http://www.infobyte.com.ar/down/Francisco%20Amato%20-%20evilgrade%20-%20ENG.pdfThird Party Advisory
• http://www.infobyte.com.ar/down/isr-evilgrade-1.0.0.tar.gzThird Party Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15225Third Party Advisory
• http://archives.neohapsis.com/archives/bugtraq/2008-07/0250.htmlBroken Link
• http://securitytracker.com/id?1020582Third Party Advisory, VDB Entry
• http://www.infobyte.com.ar/down/Francisco%20Amato%20-%20evilgrade%20-%20ENG.pdfThird Party Advisory
• http://www.infobyte.com.ar/down/isr-evilgrade-1.0.0.tar.gzThird Party Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15225Third Party Advisory

Published

Aug 1, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-3435LinkedIn Browser Toolbar 3.0.3.1100 and earlier does not pro…
• CVE-2008-3436The GUP generic update process in Notepad++ before 4.8.1 doe…
• CVE-2008-3437OpenOffice.org (OOo) before 2.1.0 does not properly verify t…
• CVE-2008-3438Apple Mac OS X does not properly verify the authenticity of …8.1
• CVE-2008-3439SpeedBit Video Acceleration before 2.2.1.8 does not properly…
• CVE-2008-3440Sun Java 1.6.0_03 and earlier versions, and possibly later v…
• CVE-2008-3442WinZip before 11.0 does not properly verify the authenticity…
• CVE-2008-3443The regular expression engine (regex.c) in Ruby 1.8.5 and ea…
• CVE-2008-3444The content layout component in Mozilla Firefox 3.0 and 3.0.…
• CVE-2008-3445SQL injection vulnerability in index.php in phpMyRealty (PMR…
• CVE-2008-3446Directory traversal vulnerability in inc/wysiwyg.php in Lett…
• CVE-2008-3447The scanning engine in F-Prot Antivirus 6.2.1 4252 allows re…