|
|
|
|
| |
Credit:
The information has been provided by Microsoft Security Bulletin MS07-047.
The original article can be found at:
http://www.microsoft.com/technet/security/bulletin/ms07-047.mspx
|
| |
Vulnerable systems:
* Windows 2000 Service Pack 4, Windows Media Player 7.1 - Update
* Windows 2000 Service Pack 4, Windows Media Player 9 - Update
* Windows XP Service Pack 2, Windows Media Player 9 - Update
* Windows XP Service Pack 2, Windows Media Player 10 - Update
* Windows XP Professional X64 Edition, Windows Media Player 10 - Update
* Windows XP Professional X64 Edition Service Pack 2, Windows Media Player 10 - Update
* Windows Server 2003 Service Pack 1, Windows Media Player 10 - Update
* Windows Server 2003 Service Pack 2, Windows Media Player 10 - Update
* Windows Server 2003 x64 Edition, Windows Media Player 10 - Update
* Windows Server 2003 x64 Edition Service Pack 2, Windows Media Player 10 - Update
* Windows XP Service Pack 2, Windows Media Player 11 - Update
* Windows XP Professional X64 Edition, Windows Media Player 11 - Update
* Windows XP Professional X64 Edition Service Pack 2, Windows Media Player 11 - Update
* Windows Vista, Windows Media Player 11 - Update
* Windows Vista x64 Edition, Windows Media Player 11 - Update
Windows Media Player Code Execution Vulnerability Parsing Skins CVE-2007-3037:
A code execution vulnerability exists in Windows Media Player skin parsing. An attacker who successfully exploited this vulnerability could take complete control of an affected system.
To view this vulnerability as a standard entry in the Common Vulnerabilities and Exposures list, see CVE-2007-3037.
Mitigating Factors for Windows Media Player Code Execution Vulnerability Parsing Skins CVE-2007-3037:
Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, which could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in your situation:
* When a user attempts to install a Windows Media Player skin file, the user is prompted with a "Windows Media Download" dialog box prior to the skin being applied.
* Attempts to exploit the vulnerability using WMZ and WMD files require the user to view or apply the skin after it is downloaded to be vulnerable.
Workarounds for Windows Media Player Code Execution Vulnerability Parsing Skins CVE-2007-3037:
* Disassociate the WMZ and WMD file extensions
Disassociation of WMZ and WMD in Windows prevents previewing or opening WMZ and WMD files in Windows Media Player.
1. Click Start, click Run, type "regedit (without the quotation marks), and then click OK.
2. Expand HKEY_CLASSES_ROOT, and click .WMZ, and then right click and select Export. Note: This will create a backup of this registry key in the My Documents folder by default.
3. In the Export Registry File window, type WMZ file association registry backup.reg and press Save. This will create a backup of this registry key in the My Documents folder by default.
4. Press the Delete key on the keyboard to delete the registry key. Select Yes to confirm the registry key deletion.
5. Repeat steps 2-5 for the WMDkey.
Impact of Workaround: This workaround prevents users from applying skin files to Windows Media Player by double clicking on them. Users can still apply skin files that are in their default skins directory.
* Un-register Wmp.dll
1. Un-registering the Wmp.dll registry key helps protect the affected system from attempts to exploit this vulnerability. To modify the Wmp.dll registry key, follow these steps.
2. Click Start, click Run, type "regsvr32 -u %windir%\system32\wmp.dll" (without the quotation marks), and then click OK.
3. When a dialog box appears that confirms that the process has been successful, click OK.
4. Select the File Types tab.
Impact of Workaround: This workaround disables the Windows Media Player and applications that use the embedded Windows Media ActiveX Control.
FAQ for Windows Media Player Code Execution Vulnerability Parsing Skins CVE-2007-3037:
What is the scope of the vulnerability?
A code execution vulnerability exists in Windows Media Player parsing skins. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs or view, change, or delete data.
What causes the vulnerability?
Windows Media Player incorrectly handles header information contained in skin files.
What is a skin file?
Skins are sets of scripts, art, media, and text files that can be combined to create a new appearance for Windows Media Player. Using skins, you can change not only the way Windows Media Player looks, but how it functions. Windows Media Player skin files are distributed in WMZ and WMD files.
What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could take complete control of an affected system. Users whose accounts are configured to have fewer user rights on the guest operating system are less impacted than users who operate with administrative user rights on the guest operating system.
How could an attacker exploit the vulnerability?
In a Web-based attack scenario, an attacker could host a specially-crafted skin file designed to exploit this vulnerability through Windows Media Player and then convince a user to view the skins file. In no case, however, would an attacker have a way to force users to visit these Web sites. Instead, an attacker would have to convince users to visit the Web site, typically by getting them to click a link in an e-mail message or in an Instant Messenger request that takes users to the attacker's Web site.
In an e-mail attack scenario, an attacker could exploit the vulnerability by sending a specially-crafted skin file to the user and by persuading the user to open the file.
What systems are primarily at risk from the vulnerability?
This vulnerability requires that a user is logged on and opens the malicious skin file in Windows Media Player for any malicious action to occur. Therefore, any systems where Windows Media Player is used frequently, such as workstations or terminal servers, are at the most risk from this vulnerability.
What does the update do?
The update removes the vulnerability by changing Windows Media Player to correctly handle header information contained in skin files.
When this security bulletin was issued, had this vulnerability been publicly disclosed?
No. Microsoft received information about this vulnerability through responsible disclosure. Microsoft had not received any information to indicate that this vulnerability had been publicly disclosed when this security bulletin was originally issued.
Windows Media Player Code Execution Vulnerability Decompressing Skins - CVE-2007-3035:
A remote code execution vulnerability exists in Windows Media Player an attacker who successfully exploited this vulnerability could take complete control of an affected system.
To view this vulnerability as a standard entry in the Common Vulnerabilities and Exposures list, see CVE-2007-3035.
Mitigating Factors for Windows Media Player Code Execution Vulnerability Decompressing Skins - CVE-2007-3035:
Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, which could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in your situation:
* When a user attempts to install a Windows Media Player skin file, the user is prompted with a "Windows Media Download" dialog box prior to the skin being applied.
* Attempts to exploit the vulnerability using WMZ and WMD files require the user to view or apply the skin after it is downloaded to be vulnerable.
Workarounds for Windows Media Player Code Execution Vulnerability Decompressing Skins - CVE-2007-3035:
* Disassociate the WMZ and WMD file extensions
Disassociation of WMZ and WMD in Windows prevents previewing or opening WMZ and WMD files in Windows Media Player.
1. Click Start, click Run, type "regedit (without the quotation marks), and then click OK.
2. Expand HKEY_CLASSES_ROOT, and click .WMZ, and then right click and select Export. Note: This will create a backup of this registry key in the My Documents folder by default.
3. In the Export Registry File window, type WMZ file association registry backup.reg and press Save. This will create a backup of this registry key in the My Documents folder by default.
4. Press the Delete key on the keyboard to delete the registry key. Select Yes to confirm the registry key deletion.
5. Repeat steps 2-5 for the WMD key.
Impact of Workaround: This workaround prevents users from applying skin files to Windows Media Player by double clicking on them. Users can still apply skin files that are in their default skins directory.
* Un-register Wmp.dll
1. Un-registering the Wmp.dll registry key helps protect the affected system from attempts to exploit this vulnerability. To modify the Wmp.dll registry key, follow these steps.
2. Click Start, click Run, type "regsvr32 -u %windir%\system32\wmp.dll" (without the quotation marks), and then click OK.
3. When a dialog box appears that confirms that the process has been successful, click OK.
4. Select the File Types tab.
Impact of Workaround: This workaround disables the Windows Media Player and applications that use the embedded Windows Media ActiveX Control.
FAQ for Windows Media Player Code Execution Vulnerability Decompressing Skins - CVE-2007-3035:
What is the scope of the vulnerability?
A code execution vulnerability exists in Windows Media Player skin parsing. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs or view, change, or delete data.
What causes the vulnerability?
Windows Media Player incorrectly handles header information contained in skin files.
What is a skin file?
Skins are sets of scripts, art, media, and text files that can be combined to create a new appearance for Windows Media Player. Using skins, you can change not only the way Windows Media Player looks, but how it functions. Windows Media Player skin files are distributed in WMZ and WMD files.
What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could take complete control of an affected system. Users whose accounts are configured to have fewer user rights on the guest operating system are less impacted than users who operate with administrative user rights on the guest operating system.
How could an attacker exploit the vulnerability?
In a Web-based attack scenario, an attacker could host a specially-crafted skin file designed to exploit this vulnerability through Windows Media Player and then convince a user to view the skins file. In no case, however, would an attacker have a way to force users to visit these Web sites. Instead, an attacker would have to convince users to visit the Web site, typically by getting them to click a link in an e-mail message or in an Instant Messenger request that takes users to the attacker's Web site.
In an e-mail attack scenario, an attacker could exploit the vulnerability by sending a specially-crafted skin file to the user and by persuading the user to open the file.
What systems are primarily at risk from the vulnerability?
This vulnerability requires that a user is logged on and opens the malicious skin file in Windows Media Player for any malicious action to occur. Therefore, any systems where Windows Media Player is used frequently, such as workstations or terminal servers, are at the most risk from this vulnerability.
What does the update do?
The update removes the vulnerability by changing Windows Media Player to correctly handle header information contained in skin files.
When this security bulletin was issued, had this vulnerability been publicly disclosed?
No. Microsoft received information about this vulnerability through responsible disclosure. Microsoft had not received any information to indicate that this vulnerability had been publicly disclosed when this security bulletin was originally issued.
|
|
|
|
|
