|
 |
|
Windows Media Player Bitmap File Processing Vulnerability
|
|
|
|
|
Secunia Advisory:
|
SA18835
|
|
|
Release Date:
|
2006-02-14
|
|
Last Update:
|
2006-02-28
|
|
|
Critical:
|
Highly critical
|
|
Impact:
|
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | Microsoft Windows Media Player 10.x
Microsoft Windows Media Player 7.x
Microsoft Windows Media Player 8.x
Microsoft Windows Media Player 9.x
|
| | CVE reference: | CVE-2006-0006 (Secunia mirror)
|
|
|
Want to know the next time vulnerabilities are fixed in this product?
- Companies can be alerted via email and SMS! |
|
|
Description:
eEye Digital Security has reported a vulnerability in Windows Media Player, which can be exploited by malicious people to compromise a user's system.
The vulnerability is caused due to a boundary error within the processing of bitmap files (.bmp) and can be exploited to cause a heap-based buffer overflow via a specially crafted bitmap file that declares its size as 0.
Successful exploitation allows execution of arbitrary code when a user e.g. visits a malicious web site, opens a malicious bitmap file (Windows Media Player is not the default handler for bitmap files), or opens a file (e.g. Word document) containing a malicious Windows Media Player (.wmp) image.
The following supported products and product combinations are NOT vulnerable:
* Windows Media Player 6.4
* Windows Media Player 10 on Windows Server 2003 SP1
* Windows XP Professional x64 Edition
* Windows Server 2003 (with or without SP1) for Itanium-based systems
* Microsoft Windows Server 2003 x64 Edition
Do you have this product installed on your home computer? Scan using the free Personal Software Inspector. Check if a vulnerable version is installed on computers in your corporate network, using the Network Software Inspector.
Solution:
Apply patch.
Windows Media Player for XP on Windows XP SP1:
http://www.microsoft.com/downloads/de...=110054F2-244D-4036-B98C-E951CBA7E9BA
Windows Media Player 9 on Windows XP SP2:
http://www.microsoft.com/downloads/de...=8F9EEF16-04F7-4DA8-A0EF-1797B52D0B4B
Windows Media Player 9 on Windows Server 2003:
http://www.microsoft.com/downloads/de...=8F9EEF16-04F7-4DA8-A0EF-1797B52D0B4B
Windows Media Player 7.1 on Windows 2000 SP4:
http://www.microsoft.com/downloads/de...=26A0B9E1-1242-4E55-B3D4-8377B83257C6
Windows Media Player 9 on Windows 2000 SP4 / Windows XP SP1:
http://www.microsoft.com/downloads/de...=8F9EEF16-04F7-4DA8-A0EF-1797B52D0B4B
Windows Media Player 10 on Windows XP SP1 / SP2:
http://www.microsoft.com/downloads/de...=182735E1-9382-4F2E-A624-D2316A96B411
Windows XP Embedded SP1:
http://www.microsoft.com/downloads/de...-b356-45eb3f4c2f1b&DisplayLang=en
Windows XP Embedded SP2:
http://www.microsoft.com/downloads/de...-b519-576cfab9d55f&DisplayLang=en
Windows 98, Windows 98 SE, and Windows ME:
Patches are available via the Windows Update web site.
Provided and/or discovered by:
Fang Xing, eEye Digital Security.
Changelog:
2006-02-15: Added additional information provided by eEye. Added link to US-CERT vulnerability note.
2006-02-28: Added fixes for Windows XP Embedded.
Original Advisory:
MS06-005 (KB911565):
http://www.microsoft.com/technet/security/Bulletin/MS06-005.mspx
eEye Digital Security:
http://www.eeye.com/html/research/advisories/AD20060214.html
Other References:
US-CERT VU#291396:
http://www.kb.cert.org/vuls/id/291396
|
|
|
|
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
|
|
|
8 Related Secunia Security Advisories
|
|
|
1. Windows Media Player Skin Handling Code Execution Vulnerabilities
|
|
2. Windows Media Player PNG Processing Buffer Overflow
|
|
3. Microsoft Various Products PNG Image Parsing Vulnerabilities
|
|
4. Windows Media Player ActiveX Control Two Vulnerabilities
|
|
5. Microsoft Windows Media Player DHTML Local Zone Access
|
|
6. Windows Media Player Interaction with Local Zone
|
|
7. Microsoft Windows Media Player ActiveX Media Library Manipulation
|
|
8. Microsoft Windows Media Player skin download vulnerability
|
|
|
Send Feedback to Secunia
|
|
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
|
|
|
|
|
|
Secunia PSI
Scan | Patch | Track
Free Download
|
|
|
Secunia Poll
|
|
|
|
|
 |
|
|
Most Popular Advisories
|
|
|
|
|
|
