exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

ms01-056

ms01-056
Posted Nov 20, 2001
Site microsoft.com

Microsoft Security Advisory MS01-056 - A buffer overflow in the handling of ASF files was discovered in Windows Media Player 6.4, allows remote attackers to execute of arbitrary code with the privileges of the user running a specially crafted ASF file. Anyone running versions 6.4, 7, or 7.1 is affected.

tags | remote, overflow, arbitrary
systems | windows
SHA-256 | e6c8b663e12c7020989589d518ede4f01f13fbc872e51249b2a57769ebc3249a

ms01-056

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----

- ----------------------------------------------------------------------
Title: Windows Media Player .ASF Processor Contains Unchecked
Buffer
Date: 20 November 2001
Software: Windows Media Player
Impact: Run code of attacker's choice
Max Risk: Critical
Bulletin: MS01-056

Microsoft encourages customers to review the Security Bulletin at:
http://www.microsoft.com/technet/security/bulletin/MS01-056.asp.
- ----------------------------------------------------------------------

Issue:
======
One of the streaming media formats supported by Windows Media
Player is Advanced Streaming Format (ASF). A security vulnerability
occurs in Windows Media Player 6.4 because the code that processes
ASF files contains an unchecked buffer.

By creating a specially malformed ASF file and inducing a user to
play it, an attacker could overrun the buffer, with either of two
results: in the simplest case, Windows Media Player 6.4 would fail;
in the more complex case, code chosen by the attacker could be made
to run on the user's computer, with the privileges of the user.
The scope of this vulnerability is rather limited. It affects only
Windows Media Player 6.4, and can only be exploited by the user
opening and deliberately playing an ASF file. There is no
capability to exploit this vulnerability via email or a web page.

However, the patch eliminates additional vulnerabilities.
Specifically, it eliminates all known vulnerabilities affecting
Windows Media Player 6.4 - discussed in Microsoft Security
Bulletins MS00-090, MS01-029, and MS01-042 - as well as some
additional variants of these vulnerabilities that were discovered
internally by Microsoft. Some of these vulnerabilities could be
exploited via email or a web page. In addition, some affect
components of Windows Media Player 6.4 that, for purposes of
backward compatibility, ship with Windows Media Player 7, and
7.1. We therefore recommend that customers running any of these
versions of Windows Media Player apply the patch to ensure that
they are fully protected against all known vulnerabilities.

Windows Media Player for Windows XP includes components of
Windows Media Player 6.4, but they are not affected by the ASF
buffer overrun or by any of the other vulnerabilities discussed
in the security bulletins listed above. However, the version 6.4
components that ship with Windows Media Player for Windows XP are
affected by some of the newly discovered variants of these
vulnerabilities. Rather than installing this patch, however, we
recommend that customers install the 25 October 2001 Critical
Update for Windows XP.

Mitigating Factors:
====================
- Windows Media Player runs in the security context of the user,
rather than as a system component. At best, an attacker could
gain the privileges of the user on the system. Systems
configured in accordance with the least privilege principal
would be at less risk from this vulnerability.

- The vulnerability could only be exploited if the user opened
and played an affected ASF file.

- The attacker would need to know the specific operating system
that the user was running in order to tailor the attack code
properly; if the attacker made an incorrect guess about the user's
operating system platform, the attack would crash the user's
Windows Media Player session, but not run code of the attacker's
choice.

Risk Rating:
============
- Internet systems: Critical
- Intranet systems: Critical
- Client systems: Critical

Patch Availability:
===================
- A patch is available to fix this vulnerability. Please read the
Security Bulletin at
http://www.microsoft.com/technet/security/bulletin/ms01-056.asp
for information on obtaining this patch.

- ---------------------------------------------------------------------

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS
ALL
WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
IN NO EVENT
SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY
DAMAGES
WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL,
LOSS OF
BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR
ITS
SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME
STATES DO
NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL
OR
INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.

-----BEGIN PGP SIGNATURE-----
Version: PGP 7.1

iQEVAwUBO/mvQY0ZSRQxA/UrAQFx9wgArkc5gTwjgy5aS2aZuC27gmPq527gEQ2A
ii7sfFeO+EpoABxRpJK/Tauwr5EMh+tfHdrZQttkv4Wnbd8QyI6yfY0l79xxBwAE
Md6h4OdUx3yCIZSbN69ZCUusUKidwqzl7VbWI+9Tdsm4QHhP4VrL5/C5ZbuxPXQ9
2gbFYtLTxPNSvtONiStQbSnFSTQdsdsytN4YpGLqdtmkBHTTbjXRp6mmk1DmUMD2
BR7+Saf2knoSMW6SKYZRgEV0UQleom0qDWltGUDuxs2eSUFmpL9Hn3t+GlyYhtbO
S4lc9z5vqA3NGb0oeG2NyI2SspwEckoTtxf2gdyOZIe7OtLNtno9pg==
=uEWm
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    28 Files
  • 16
    Jul 16th
    6 Files
  • 17
    Jul 17th
    34 Files
  • 18
    Jul 18th
    6 Files
  • 19
    Jul 19th
    34 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close