|
Microsoft Windows Media Player skin download vulnerability
|
|
Secunia Advisory:
|
SA8742
|
|
|
Release Date:
|
2003-05-07
|
|
Popularity:
|
50,111 views
|
|
|
Critical:
|
Moderately critical
|
|
Impact:
|
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| OS: | Microsoft Windows XP Home Edition
Microsoft Windows XP Professional
|
|
| Software: | Microsoft Windows Media Player 7.x
Microsoft Windows Media Player 8.x
|
|
|
Secunia CVSS-2 Score:
|
Available in Secunia business solutions 
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities
|
|
| Advisory Content (Page 1 of 3) | [ 1 ] [ 2 ] [ 3 ] | |
|
Description:
A flaw has been identified in Microsoft Windows Media Player, which could allow malicious HTML documents to place arbitrary files on the users system.
The problem exists because Microsoft Windows Media Player by default accepts and installs skins without prompting the user. Normally this would be safe because these files will be placed in a location set by Windows Media Player. However, a flaw exists which allows a malicious HTML document to supply any path by using hex-encoded backslashes.
The files would still be named .wmz and would be useless for a hacker. However, by manipulating the Content-disposition HTTP header it is also possible to supply arbitrary file extensions.
Existing files can't be overwritten without prompting the user. It could be possible to place .dll files that would be used instead of the original ones by placing them in the "\windows" folder instead of "\windows\system32".
By placing executable files in the "startup" folder it may be possible to execute the code automatically on next reboot or login.
Change Page:
[ 1 ] [ 2 ] [ 3 ]
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
