Security Update for Windows Media Player (KB828026)

Advertisement (Why?)

A security issue has been identified that could allow an attacker to execute commands on a computer running Windows Media Player. You can help protect your computer by installing this update from Microsoft.

Download: Security Update for Windows Media Player 9 Series for 2000, Windows XP, and Server 2003

Download: Security Update for Windows Media Player 6.4, 7.1 or 9 for ME

Download: Security Update for Windows Media Player 6.4 for NT 4.0 Server

View: Read the Security Bulletin

Features

* Open component architecture allowing third-party developers to extend functionality of the player
* Audio formats supported "out-of-the-box": WAV, AIFF, VOC, AU, SND, Ogg Vorbis, MPC, MP2, MP3
* Audio formats supported through official addons: MPEG-4 AAC, FLAC, OggFLAC, Monkey's Audio,
WavPack, Speex, CDDA, TFMX, SPC, various MOD types; extraction on-the-fly from RAR & ZIP archives
* Full Unicode support on Windows NT
* ReplayGain support
* Low memory footprint, efficient handling of really large playlists
* Advanced file info processing capabilities (generic file info box and masstagger)
* Highly customizable playlist display
* Customizable keyboard shortcuts
* Most of standard components are opensourced under BSD license (source included with the SDK)

Changelog for fb2k v0.7.1 :

- added option to write log file in console
- fixed 0.7 problem with mpglib and some intensity stereo files
- DDE support (introduced in early 0.7) now optional / disabled by default (reduced "memory usage" shortly after startup)
- added option to update playlist with time display / VBR bitrate / dynamic HTTP titles / etc
- new and improved masstagger
- new smarter/faster playlist search
- added 7zip unpacker (kode54)
- added new DirectSound output with fades on seek/pause/stop

(5 replies) #1 ripgut on 04 Oct 2003 - 08:18

And yet another

#1.1 Emon on 04 Oct 2003 - 08:47

STFU ...so you don't want them to fix the security holes then ??

Do you have any clue about software engineering ? if not then keep your mouth shut.

#1.2 ripgut on 05 Oct 2003 - 04:07

QUOTE (#1.1)

STFU

you gonna make me stfu? its funny how peoples get bold behind there rigs but are scared as hell in person

#1.3 JaggedFlame on 05 Oct 2003 - 16:04

We've seen pictures of you, and I'll tell ya that you really don't look all that tough.

#1.4 ripgut on 05 Oct 2003 - 17:47

what are u some kinda TOUGH expert ?

#1.5 JaggedFlame on 06 Oct 2003 - 03:04

More of an expert than you, it seems.

(1 reply) #2 MitchShrader on 04 Oct 2003 - 08:49

So us folks who run winmedia 6.4 on win2k (sp4) are NOT VULNERABLE.. wooHOO, i knew sooner or later dodging billy's dodgy DRM related 'upgrades' with their freedom eroding monopoly hypester crapola would pay off. a tiny dividend, sure.. but by golly i've waited for this. if open source folks would just bugpatch and tweak billys code up to standard we could BLOW OFF XP and winmedia DRM and (un) trusted computing. yes, i use windows.. yes, open source is better (lots of ways) but interplatform compatibility and convenience are necessary for a bridge to sensible pricing and NOT *palladium*. somebody start a NON-trusted bios company. i'll invest..

#2.1 JaggedFlame on 04 Oct 2003 - 13:06

Yeah, you moron, we all upgraded to verison 9 just because the only thing they added was DRM support.

Use your damn brain sometimes.

#3 Emon on 04 Oct 2003 - 08:51

do you even have a job to invest that money??

loser ..

#4 BrY on 04 Oct 2003 - 10:33

what did the patch upgrade the version to? i still have 9.00.00.3075

(4 replies) #5 Dazzla on 04 Oct 2003 - 10:35

This ****ed up my media player. Now when it starts it says "the file wmp.dll has a file number 9.0.0.3008 where 9.0.0.3075 was expected"

What the hell is that all about?

#5.1 Jedimark on 04 Oct 2003 - 11:20

You need to restart your computer.

#5.2 Dazzla on 04 Oct 2003 - 12:54

Really? I didn't think of restarting

I had to use system restore to fix it, this is one patch I won't be applying.

#5.3 JaggedFlame on 04 Oct 2003 - 13:07

You could've tried using Resource Hacker to change the version number of that file. My guess is that something happened because you have a custom WMP taskbar skin.

#5.4 Dazzla on 04 Oct 2003 - 14:42

The taskbar skin is wmploc.dll and I don't have it modified.

#6 Electroglitter on 04 Oct 2003 - 11:35

dazzla
i dont think what jedimark will actually will work, i installed the patch, it didnt tell me to reboot, so i started windows media player and checked the version number and it was 9.0.0.3075. i then installed the IE 6 patch, which did tell me to restart, both patches installed ok, try rebooting anyway, see if i works then, if not apply then patch again...

#7 s.a.m. on 04 Oct 2003 - 14:19

#2: I believe the article is incorrect. Extract the WMP9 patch, look at the file manifest and venture into the update.inf. You'll see there are file updates for 6.4, 7.1, 8.0 and 9.0. I haven't tested it though yet.
In addition, for WMP9 this security update (that isn't a security bulletin

) supersedes MS03-021.

This guy's security checklist always gets it right and is more accurate than MS's

:
http://www.happytech.net/bib/Checklist/MSPATCHES.XLS

#8 Daybreak on 04 Oct 2003 - 16:58

Interestingly, this isn't on Microsoft's bulletins and security updates list.. You have to go to the actual download page to find the link..

So exactly what was the vulnerability? Why is there no updated page?

#9 Trix on 04 Oct 2003 - 18:12

hey how can i get rid of this its totaly screwed up my playback!! its all juddery and crap

(1 reply) #10 Sickmyduck on 04 Oct 2003 - 18:40

So what's the most current version no. now?

#10.1 Unforgiven on 05 Oct 2003 - 14:27

9.00.00.3075

#11 Coolme on 06 Oct 2003 - 00:12

Is it just me or are they patches bigger now? (2 megabytes)

#12 zachdms on 12 Dec 2003 - 17:21

A: It wasn't a vulnerability, it was a Security Hardening - just preemptively providing more security just in random case.
B: If you got the "Version xxxx found, Version xxxx expected" message, that really does mean that you need to reboot. You should have only gotten that message if the package installer told you to reboot but you chose not to. If a reboot didn't clear it up, simply running c:windowsinfunregmp2.exe /UpdateWMP will clear it up.

-Z (speaking for myself)

Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!

Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.

Neowin.net