Microsoft Security Bulletin MS06-005:
Vulnerability in Windows Media Player Could Allow Remote Code Execution
(911565)
Bulletin URL:
<http://www.microsoft.com/technet/security/Bulletin/MS06-005.mspx>
Version Number: 1.0
Issued Date: Tuesday, February 14, 2006
Impact of Vulnerability: Remote Code Execution
Maximum Severity Rating: Critical
Patch(es) Replaced: This bulletin replaces a prior security update. See
the frequently asked questions (FAQ) section of this bulletin for the
complete list.
Caveats: None
Tested Software:
Affected Software:
------------------
* Windows Media Player for XP on Microsoft Windows XP Service Pack 1
<http://tinyurl.com/9bdyl>
* Windows Media Player 9 on Microsoft Windows XP Service Pack 2
<http://tinyurl.com/ct3zp>
* Windows Media Player 9 on Microsoft Windows Server 2003 Microsoft
Windows 98, Microsoft Windows 98 Second Edition (SE), and Microsoft
Windows Millennium Edition (ME) - Review the FAQ section of this
bulletin for details about these operating systems. Windows Server 2003
(all versions)
<http://tinyurl.com/ct3zp>
Affected Components:
--------------------
* Microsoft Windows Media Player 7.1 when installed on Windows 2000
Service Pack 4
<http://tinyurl.com/8f75k>
* Microsoft Windows Media Player 9 when installed on Windows 2000
Service Pack 4 or Windows XP Service Pack 1
<http://tinyurl.com/ct3zp>
* Microsoft Windows Media Player 10 when installed on Windows XP Service
Pack 1 or Windows XP Service Pack 2
<http://tinyurl.com/a7zum>
Technical Description:
----------------------
* Windows Media Player Vulnerability - CVE-2006-0006 A remote code
execution vulnerability exists in Windows Media Player because of the
way that it handles processing bitmap files. An attacker could exploit
the vulnerability by constructing a malicious bitmap file (.bmp) that
could potentially allow remote code execution if a user visited a
malicious Web site or viewed a malicious e-mail message. An attacker who
successfully exploited this vulnerability could take complete control of
an affected system. However, significant user interaction is required to
exploit this vulnerability.
This email is sent to NTBugtraq automagically as a service to my
subscribers. (v4.01.2194.14842)
Cheers,
Russ Cooper - Senior Scientist - Cybertrust/NTBugtraq Editor
--
NTBugtraq Editor's Note:
Most viruses these days use spoofed email addresses. As such, using an
Anti-Virus product which automatically notifies the perceived sender of a
message it believes is infected may well cause more harm than good. Someone who
did not actually send you a virus may receive the notification and scramble
their support staff to find an infection which never existed in the first
place. Suggest such notifications be disabled by whomever is responsible for
your AV, or at least that the idea is considered.
--
