(CIAC Issues Bulletin L-089) Re: Microsoft Windows Media Player May Allow Remote Users to Execute Code Contained in Internet Shortcuts and View Files on the Media Player's Host
|
|
SecurityTracker Alert ID: 1001653 |
|
SecurityTracker URL: http://securitytracker.com/id/1001653
|
|
CVE Reference:
CVE-2001-0243
(Links to External Site)
|
Date: May 30 2001
|
Impact:
Disclosure of system information, Execution of arbitrary code via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 6.4, 7
|
Description:
Microsoft disclosed that their Windows Media Player contains a vulnerability that could allow a remote user to cause HTML code on the host to be executed and, as a result, view certain files on the host.
The vulnerability is in how Windows Media Player handles Internet shortcuts. Reportedly, Windows Media Player has a flaw that causes it to save Internet shortcuts to the user's Temporary Files folder with a fixed known filename. As a result, HTML code can be stored in a shortcut and launched via a web page or HTML based e-mail message. In this case, the code would execute in the Local Computer Zone rather than the Internet Zone.
A remote user could exploit this vulnerability to read files on the host. Only file types that can be opened in a browser window (such as .txt, .jpg, .gif, or .htm, but not file types such as .exe, .doc, and .xls).
|
Impact:
A remote user could cause HTML code to be executed on another Media Player's host that would allow the remote user to view certain files on that host.
|
Solution:
The vendor has released a fix. For users of version 6.4, a patch is available. For users of version 7, and upgrade to version 7.1 is available.
|
Vendor URL: www.microsoft.com/technet/security/bulletin/MS01-029.asp (Links to External Site)
|
Cause:
Access control error, Randomization error
|
Underlying OS: Windows (Me), Windows (NT), Windows (95), Windows (98), Windows (2000)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Subject: CIAC Bulletin L-089: Windows Unchecked Buffer in Media Player .ASX Processor
|
[For Public Release]
-----BEGIN PGP SIGNED MESSAGE-----
__________________________________________________________
The U.S. Department of Energy
Computer Incident Advisory Center
___ __ __ _ ___
/ | /_\ /
\___ __|__ / \ \___
__________________________________________________________
INFORMATION BULLETIN
Windows Unchecked Buffer in Media Player .ASX Processor
[Microsoft MS01-029]
May 25, 2001 21:00 GMT Number L-089
______________________________________________________________________________
PROBLEM: This addresses 2 vulnerabilities: the code parsing .ASX files
has an unchecked buffer, enabling a malicious user to
run code of her choice. Secondly, Windows Media Player has a
flaw in saving Internet shortcuts to the user's Temporary Files
folder with a fixed known filename.
PLATFORM: Windows Media Player 6.4 and 7
DAMAGE: Unauthorized disclosure, and/or limited executing code of
choice.
SOLUTION: Apply the patches as described below.
______________________________________________________________________________
VULNERABILITY MEDIUM. In the first, the attacker can run only limited code,
ASSESSMENT: and in the second, the attacker would need to know the exact
name of each file to be read, and could not modify the file.
______________________________________________________________________________
[****** Start Microsoft Advisory ******]
http://www.ciac.org/ciac/bulletins/l-089.shtml
[****** End Microsoft Advisory ******]
-----BEGIN PGP SIGNATURE-----
Version: 4.0 Business Edition
iQCVAwUBOxQaw7nzJzdsy3QZAQG55gP+N+LE6c/XiRMPG+Zq7GwrW3P78Ggxa41M
pEjA41Np4Vlx+QwyyVRduVnB1ZaKVH5EvZNH7tqtaran0exGdLgkauuzuA0+QKQN
oTogpRQcJC6zkdx12IwjXmot1dqzNGAsgJp7ibiAAGAufnCXynMpWNajFxJVWPsP
4X2tCdRkFj8=
=3s4a
-----END PGP SIGNATURE-----
-+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+
This message was posted through the FIRST mailing list server. If you
wish to unsubscribe from this mailing list, send the message body of
"unsubscribe first-info" to first-majordomo@FIRST.ORG
-+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+
|
|
