|
|
|
|
| |
Credit:
The information has been provided by eEye Advisories .
The original article can be found at: http://www.eeye.com/html/research/advisories/AD20060214.html
The vendor advisory can be found at: http://www.securiteam.com/windowsntfocus/5DP0G1FHPS.html
|
| |
Vulnerable Systems:
* Windows Media Player for XP on Microsoft Windows XP Service Pack 1
* Windows Media Player 9 on Microsoft Windows XP Service Pack 2
* Windows Media Player 9 on Microsoft Windows Server 2003
* Microsoft Windows 98
* Microsoft Windows 98 Second Edition (SE)
* Microsoft Windows Millennium Edition (ME)
* Microsoft Windows Media Player 7.1 when installed on Windows 2000 Service Pack 4
* Microsoft Windows Media Player 9 when installed on Windows 2000 Service Pack 4 or Windows XP Service Pack 1
* Microsoft Windows Media Player 10 when installed on Windows XP Service Pack 1 or Windows XP Service Pack 2
Immune Systems:
* Windows Media Player 6.4 on all Microsoft Windows operating systems
* Windows Media Player 10 on Microsoft Windows Server 2003 Service Pack 1
* Microsoft Windows XP Professional x64 Edition
* Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems
* Microsoft Windows Server 2003 x64 Edition
Windows Media Player can play bitmap format files, such as a .bmp file and use Windows Media Player (WMP) to decode a dll process of a .bmp file.
If a bitmap file declears with a size of 0, Windows Media Player is unable to handle the bitmap currectly.
In this case, WMP will allocate a heap size of 0 bytes, but it will copy the heap with the real file length. A specially crafted bitmap file that declares it's size as 0 will cause the the buffer overflow. When changing the size to 0 bytes, WMP will allocate the heap of the new function, so actually it will allocate 0x2*8(heap) sized heap. When it copy the date it will check two conditions:
1. Less than the size - the bmp head, this is 0-0xe(the bmp head size) = 0xfffffff2
2. Less than 0x1000
So if the real file size is less than 0x1000, it will copy the real date size to the 0x2*8 heap, if the real file size is larger than 0x1000, it will copy the first 0x1000 to the 0x2*8 heap.
CVE Information:
CVE-2006-0006
|
|
|
|
|
