The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Vulnerabilities in Windows Media Player Allows Code Execution (MS07-047)
------------------------------------------------------------------------
SUMMARY
Vulnerabilities in Windows Media Player allow code execution if a user
viewed a specially crafted file. Users whose accounts are configured to
have fewer user rights on the system could be less impacted than users who
operate with administrative user rights.
DETAILS
Vulnerable systems:
* Windows 2000 Service Pack 4, Windows Media Player 7.1 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=9f46b1fc-ee7b-437f-9492-67d003711021>
Update
* Windows 2000 Service Pack 4, Windows Media Player 9 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=bd4a6474-5fde-415e-840e-7d973cb71c95>
Update
* Windows XP Service Pack 2, Windows Media Player 9 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=bd4a6474-5fde-415e-840e-7d973cb71c95>
Update
* Windows XP Service Pack 2, Windows Media Player 10 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=48f5a9d3-b859-4cb6-a68e-abde76a14782>
Update
* Windows XP Professional X64 Edition, Windows Media Player 10 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=949580be-cbb3-4271-8ca0-0ead7f2d8801>
Update
* Windows XP Professional X64 Edition Service Pack 2, Windows Media
Player 10 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=949580be-cbb3-4271-8ca0-0ead7f2d8801>
Update
* Windows Server 2003 Service Pack 1, Windows Media Player 10 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=8d9f1fdf-6d4c-44d4-9b5f-bdbe8ac28d7f>
Update
* Windows Server 2003 Service Pack 2, Windows Media Player 10 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=8d9f1fdf-6d4c-44d4-9b5f-bdbe8ac28d7f>
Update
* Windows Server 2003 x64 Edition, Windows Media Player 10 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=2c04c7f2-728e-43bd-8574-26e411fcd129>
Update
* Windows Server 2003 x64 Edition Service Pack 2, Windows Media Player 10
-
<http://www.microsoft.com/downloads/details.aspx?FamilyId=2c04c7f2-728e-43bd-8574-26e411fcd129>
Update
* Windows XP Service Pack 2, Windows Media Player 11 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=a690d042-1137-4aaf-bd0e-565ea04d1f2b>
Update
* Windows XP Professional X64 Edition, Windows Media Player 11 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=bdc89f34-c1ff-46ab-b52d-c02d51c5c373>
Update
* Windows XP Professional X64 Edition Service Pack 2, Windows Media
Player 11 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=bdc89f34-c1ff-46ab-b52d-c02d51c5c373>
Update
* Windows Vista, Windows Media Player 11 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=80e5167c-4f75-4ce3-8b15-2f50958deec8>
Update
* Windows Vista x64 Edition, Windows Media Player 11 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=bf30b714-d6e7-47ea-b79e-84c18370a661>
Update
Windows Media Player Code Execution Vulnerability Parsing Skins
CVE-2007-3037:
A code execution vulnerability exists in Windows Media Player skin
parsing. An attacker who successfully exploited this vulnerability could
take complete control of an affected system.
To view this vulnerability as a standard entry in the Common
Vulnerabilities and Exposures list, see
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3037>
CVE-2007-3037.
Mitigating Factors for Windows Media Player Code Execution Vulnerability
Parsing Skins CVE-2007-3037:
Mitigation refers to a setting, common configuration, or general
best-practice, existing in a default state, which could reduce the
severity of exploitation of a vulnerability. The following mitigating
factors may be helpful in your situation:
* When a user attempts to install a Windows Media Player skin file, the
user is prompted with a "Windows Media Download" dialog box prior to the
skin being applied.
* Attempts to exploit the vulnerability using WMZ and WMD files require
the user to view or apply the skin after it is downloaded to be
vulnerable.
Workarounds for Windows Media Player Code Execution Vulnerability Parsing
Skins CVE-2007-3037:
* Disassociate the WMZ and WMD file extensions
Disassociation of WMZ and WMD in Windows prevents previewing or opening
WMZ and WMD files in Windows Media Player.
1. Click Start, click Run, type "regedit (without the quotation marks),
and then click OK.
2. Expand HKEY_CLASSES_ROOT, and click .WMZ, and then right click and
select Export. Note: This will create a backup of this registry key in the
My Documents folder by default.
3. In the Export Registry File window, type WMZ file association registry
backup.reg and press Save. This will create a backup of this registry key
in the My Documents folder by default.
4. Press the Delete key on the keyboard to delete the registry key. Select
Yes to confirm the registry key deletion.
5. Repeat steps 2-5 for the WMDkey.
Impact of Workaround: This workaround prevents users from applying skin
files to Windows Media Player by double clicking on them. Users can still
apply skin files that are in their default skins directory.
* Un-register Wmp.dll
1. Un-registering the Wmp.dll registry key helps protect the affected
system from attempts to exploit this vulnerability. To modify the Wmp.dll
registry key, follow these steps.
2. Click Start, click Run, type "regsvr32 -u %windir%\system32\wmp.dll"
(without the quotation marks), and then click OK.
3. When a dialog box appears that confirms that the process has been
successful, click OK.
4. Select the File Types tab.
Impact of Workaround: This workaround disables the Windows Media Player
and applications that use the embedded Windows Media ActiveX Control.
FAQ for Windows Media Player Code Execution Vulnerability Parsing Skins
CVE-2007-3037:
What is the scope of the vulnerability?
A code execution vulnerability exists in Windows Media Player parsing
skins. An attacker who successfully exploited this vulnerability could
take complete control of an affected system. An attacker could then
install programs or view, change, or delete data.
What causes the vulnerability?
Windows Media Player incorrectly handles header information contained in
skin files.
What is a skin file?
Skins are sets of scripts, art, media, and text files that can be combined
to create a new appearance for Windows Media Player. Using skins, you can
change not only the way Windows Media Player looks, but how it functions.
Windows Media Player skin files are distributed in WMZ and WMD files.
What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could take
complete control of an affected system. Users whose accounts are
configured to have fewer user rights on the guest operating system are
less impacted than users who operate with administrative user rights on
the guest operating system.
How could an attacker exploit the vulnerability?
In a Web-based attack scenario, an attacker could host a specially-crafted
skin file designed to exploit this vulnerability through Windows Media
Player and then convince a user to view the skins file. In no case,
however, would an attacker have a way to force users to visit these Web
sites. Instead, an attacker would have to convince users to visit the Web
site, typically by getting them to click a link in an e-mail message or in
an Instant Messenger request that takes users to the attacker's Web site.
In an e-mail attack scenario, an attacker could exploit the vulnerability
by sending a specially-crafted skin file to the user and by persuading the
user to open the file.
What systems are primarily at risk from the vulnerability?
This vulnerability requires that a user is logged on and opens the
malicious skin file in Windows Media Player for any malicious action to
occur. Therefore, any systems where Windows Media Player is used
frequently, such as workstations or terminal servers, are at the most risk
from this vulnerability.
What does the update do?
The update removes the vulnerability by changing Windows Media Player to
correctly handle header information contained in skin files.
When this security bulletin was issued, had this vulnerability been
publicly disclosed?
No. Microsoft received information about this vulnerability through
responsible disclosure. Microsoft had not received any information to
indicate that this vulnerability had been publicly disclosed when this
security bulletin was originally issued.
Windows Media Player Code Execution Vulnerability Decompressing Skins -
CVE-2007-3035:
A remote code execution vulnerability exists in Windows Media Player an
attacker who successfully exploited this vulnerability could take complete
control of an affected system.
To view this vulnerability as a standard entry in the Common
Vulnerabilities and Exposures list, see
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3035>
CVE-2007-3035.
Mitigating Factors for Windows Media Player Code Execution Vulnerability
Decompressing Skins - CVE-2007-3035:
Mitigation refers to a setting, common configuration, or general
best-practice, existing in a default state, which could reduce the
severity of exploitation of a vulnerability. The following mitigating
factors may be helpful in your situation:
* When a user attempts to install a Windows Media Player skin file, the
user is prompted with a "Windows Media Download" dialog box prior to the
skin being applied.
* Attempts to exploit the vulnerability using WMZ and WMD files require
the user to view or apply the skin after it is downloaded to be
vulnerable.
Workarounds for Windows Media Player Code Execution Vulnerability
Decompressing Skins - CVE-2007-3035:
* Disassociate the WMZ and WMD file extensions
Disassociation of WMZ and WMD in Windows prevents previewing or opening
WMZ and WMD files in Windows Media Player.
1. Click Start, click Run, type "regedit (without the quotation marks),
and then click OK.
2. Expand HKEY_CLASSES_ROOT, and click .WMZ, and then right click and
select Export. Note: This will create a backup of this registry key in the
My Documents folder by default.
3. In the Export Registry File window, type WMZ file association registry
backup.reg and press Save. This will create a backup of this registry key
in the My Documents folder by default.
4. Press the Delete key on the keyboard to delete the registry key. Select
Yes to confirm the registry key deletion.
5. Repeat steps 2-5 for the WMD key.
Impact of Workaround: This workaround prevents users from applying skin
files to Windows Media Player by double clicking on them. Users can still
apply skin files that are in their default skins directory.
* Un-register Wmp.dll
1. Un-registering the Wmp.dll registry key helps protect the affected
system from attempts to exploit this vulnerability. To modify the Wmp.dll
registry key, follow these steps.
2. Click Start, click Run, type "regsvr32 -u %windir%\system32\wmp.dll"
(without the quotation marks), and then click OK.
3. When a dialog box appears that confirms that the process has been
successful, click OK.
4. Select the File Types tab.
Impact of Workaround: This workaround disables the Windows Media Player
and applications that use the embedded Windows Media ActiveX Control.
FAQ for Windows Media Player Code Execution Vulnerability Decompressing
Skins - CVE-2007-3035:
What is the scope of the vulnerability?
A code execution vulnerability exists in Windows Media Player skin
parsing. An attacker who successfully exploited this vulnerability could
take complete control of an affected system. An attacker could then
install programs or view, change, or delete data.
What causes the vulnerability?
Windows Media Player incorrectly handles header information contained in
skin files.
What is a skin file?
Skins are sets of scripts, art, media, and text files that can be combined
to create a new appearance for Windows Media Player. Using skins, you can
change not only the way Windows Media Player looks, but how it functions.
Windows Media Player skin files are distributed in WMZ and WMD files.
What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could take
complete control of an affected system. Users whose accounts are
configured to have fewer user rights on the guest operating system are
less impacted than users who operate with administrative user rights on
the guest operating system.
How could an attacker exploit the vulnerability?
In a Web-based attack scenario, an attacker could host a specially-crafted
skin file designed to exploit this vulnerability through Windows Media
Player and then convince a user to view the skins file. In no case,
however, would an attacker have a way to force users to visit these Web
sites. Instead, an attacker would have to convince users to visit the Web
site, typically by getting them to click a link in an e-mail message or in
an Instant Messenger request that takes users to the attacker's Web site.
In an e-mail attack scenario, an attacker could exploit the vulnerability
by sending a specially-crafted skin file to the user and by persuading the
user to open the file.
What systems are primarily at risk from the vulnerability?
This vulnerability requires that a user is logged on and opens the
malicious skin file in Windows Media Player for any malicious action to
occur. Therefore, any systems where Windows Media Player is used
frequently, such as workstations or terminal servers, are at the most risk
from this vulnerability.
What does the update do?
The update removes the vulnerability by changing Windows Media Player to
correctly handle header information contained in skin files.
When this security bulletin was issued, had this vulnerability been
publicly disclosed?
No. Microsoft received information about this vulnerability through
responsible disclosure. Microsoft had not received any information to
indicate that this vulnerability had been publicly disclosed when this
security bulletin was originally issued.
ADDITIONAL INFORMATION
The information has been provided by Microsoft Security Bulletin MS07-047.
The original article can be found at:
<http://www.microsoft.com/technet/security/bulletin/ms07-047.mspx>
http://www.microsoft.com/technet/security/bulletin/ms07-047.mspx
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
