Secunia

A flaw has been identified in Microsoft Windows Media Player, which could allow malicious HTML documents to place arbitrary files on the users system.

The problem exists because Microsoft Windows Media Player by default accepts and installs skins without prompting the user. Normally this would be safe because these files will be placed in a location set by Windows Media Player. However, a flaw exists which allows a malicious HTML document to supply any path by using hex-encoded backslashes.

The files would still be named .wmz and would be useless for a hacker. However, by manipulating the Content-disposition HTTP header it is also possible to supply arbitrary file extensions.

Existing files can't be overwritten without prompting the user. It could be possible to place .dll files that would be used instead of the original ones by placing them in the "\windows" folder instead of "\windows\system32".

By placing executable files in the "startup" folder it may be possible to execute the code automatically on next reboot or login.

Solution
This vulnerability does not exist in Microsoft Windows Media Player 9.
Further details available in Customer Area

Provided and/or discovered by
Jouko Pynnonen

Original Advisory
Will be published on this address:
http://www.microsoft.com/technet/security/bulletin/MS03-017.asp

Deep Links
Links available in Customer Area