|
|
|
|
| |
Credit:
The information has been provided by iDEFENSE Labs.
The original article can be found at: http://www.idefense.com/intelligence/vulnerabilities/display.php?id=393
The vendor advisory can be found at: http://www.microsoft.com/technet/security/bulletin/MS06-006.mspx
|
| |
Vulnerable Systems:
* Windows Media Player version 9
* Windows Media Player version 10
Windows Media Player (WMP) can be launched as a plugin in popular browsers to view Windows Media Player file types from web pages.
A vulnerability in the Windows Media Player plugin can be triggered from several popular browsers such as FireFox and Netscape. The issue specifically can be triggered when certain browsers launch it with an overly long embed src tag from a malicious html page.
Upon successful exploitation, attackers will be able to overwrite a Structured Exception Handler (SEH) address and execute arbitrary code on the system.
The vulnerability specifically lays in npdsplay.10001040 where a user supplied string is copied to a stack based buffer:
1000171A C1E9 02 SHR ECX,2
>> 1000171D F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
1000171F 8BC8 MOV ECX,EAX
With properly crafted input the attacker is able to execute code of his choice. Due to unicode translations, shellcode characters are somewhat limited to character code values below 0x80. Successful exploitation of this vulnerability is not significantly impacted by this limitation.
Successful exploitation of this vulnerability allows attackers to execute code within the context of the currently logged in user. The victim would have to visit a malicious website using Firefox, Netscape browsers for example and have Windows Media Player installed.
Workaround:
Associate media files with different media player then Microsoft Windows Media Player.
CVE Information:
CVE-2006-0005
Disclosure Timeline:
08/31/2005 Initial vendor notification
08/31/2005 Initial vendor response
02/14/2006 Coordinated public disclosure
|
|
|
|
|
