MS03-021: Flaw In Windows Media Player

[Steven]

-----BEGIN PGP SIGNED MESSAGE-----

- - ------------------------------------------------------------------

Title: Flaw In Windows Media Player May Allow Media Library

Access (819639)

Date: 25 June 2003

Software: Microsoft® Windows® Media Player 9 Series

Impact: Information disclosure

Max Risk: Moderate

Bulletin: MS03-021

Microsoft encourages customers to review the Security Bulletins at:

http://www.microsoft.com/technet/security/...in/MS03-021.asp

http://www.microsoft.com/security/security...ns/ms03-021.asp

- - ------------------------------------------------------------------

Issue:

======

An ActiveX control included with Windows Media Player 9 Series

allows Web page authors to create Web pages that can play media and

provide a user interface by which the user can control playback.

When a user visits a Web page with embedded media, the ActiveX

control provides a user interface that allows the user to take such

actions as pausing or rewinding the media.

A flaw exists in the way in which the ActiveX control provides

access to information on the user's computer. A vulnerability exists

because an attacker could invoke the ActiveX control from script

code, which would allow the attacker to view and manipulate metadata

contained in the media library on the user's computer.

To exploit this flaw, an attacker would have to host a malicious Web

site that contained a Web page designed to exploit this

vulnerability, and then persuade a user to visit that site-an

attacker would have no way to force a user to the site. An attacker

could also embed a link to the malicious site in an HTML e-mail and

send it to the user. After the user previewed or opened the e-mail,

the malicious site could be visited automatically without further

user interaction.

The attacker would only have access to manipulate the media library

on the user's computer. The attacker would not be able to browse the

user's hard disk and would not have access to passwords or encrypted

data. The attacker would not be able to modify files on the user's

hard disk, but could modify the contents of any Media Library

entries associated with those files. The attacker might also be able

to determine the user name of the logged-on user by examining the

directory paths to media files.

Mitigating Factors:

====================

- By default, Internet Explorer on Windows Server 2003 runs in

Enhanced Security Configuration. This default configuration of

Internet Explorer blocks this attack.

- The attacker could only gain access to information contained in

the Windows Media Library

- The attacker would not be able to execute code on the system or

delete files on the user's hard disk.

Risk Rating:

============

Moderate

Patch Availability:

===================

- A patch is available to fix this vulnerability. Please read the

Security Bulletins at

http://www.microsoft.com/technet/security/...in/ms03-021.asp

http://www.microsoft.com/security/security...ns/ms03-021.asp

for information on obtaining this patch.

Acknowledgment:

===============

- Jelmer ([email protected])

- ------------------------------------------------------------------

[zhangm Supervisor]

Another one? :huh:

*Shock and Awe*

[Unforgiven]

Oh yes :laugh: