Microsoft Windows Media Player Bitmap Handling Buffer Overflow Vulnerability

Bugtraq ID:	16633
Class:	Boundary Condition Error
CVE:	CVE-2006-0006
Remote:	Yes
Local:	No
Published:	Feb 14 2006 12:00AM
Updated:	Apr 12 2006 04:47PM
Credit:	Discovered by Marc Maiffret of eEye.
Vulnerable:	Nortel Networks Symposium TAPI Service Provider Nortel Networks Symposium Agent Nortel Networks MCS 5200 3.0 Nortel Networks MCS 5100 3.0 Nortel Networks IP softphone 2050 Nortel Networks IP Address Domain Manager Nortel Networks Enterprise Network Management System Nortel Networks Contact Center Web Client Nortel Networks Contact Center Multimedia Nortel Networks Contact Center Manager Nortel Networks Contact Center Express Nortel Networks Contact Center Nortel Networks CallPilot 3.0 Nortel Networks CallPilot 1001rp Microsoft Windows Media Player 9.0 + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 Web Edition Microsoft Windows Media Player 8.0 Microsoft Windows Media Player 7.1 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 Microsoft Windows Media Player 10.0 Microsoft Windows ME Microsoft Windows 98SE Microsoft Windows 98
Not Vulnerable:

Microsoft Windows Media Player Bitmap Handling Buffer Overflow Vulnerability

Microsoft Windows Media Player is prone to a remote buffer-overflow vulnerability.

The vulnerability arises when the application handles a skin file containing a specially crafted bitmap image. This issue can also be triggered by just supplying a malicious bitmap to the application. Note, however, that Windows Media Player is not the default handler for bitmap files.

A successful attack can corrupt process memory and result in arbitrary code execution. This may facilitate a remote compromise in the context of the vulnerable user.

Microsoft Windows Media Player Bitmap Handling Buffer Overflow Vulnerability

Proof-of-concept code has been released for this vulnerability:

http://www.securityfocus.com/data/vulnerabilities/exploits/20060215.wmp-ms06-005.cpp

• /data/vulnerabilities/exploits/20060215.wmp-ms06-005.cpp

Microsoft Windows Media Player Bitmap Handling Buffer Overflow Vulnerability

Solution:
Microsoft has released updates to address this vulnerability in supported versions of the Windows operating system.


Microsoft Windows Media Player 10.0

• Microsoft Security Update for Windows Media Player 10 for Windows XP (KB911565)
  Fix for Microsoft Windows XP Service Pack 1 and Windows XP Service Pack 2.
  http://www.microsoft.com/downloads/details.aspx?familyid=182735E1-9382 -4F2E-A624-D2316A96B411&displaylang=en

Microsoft Windows Media Player 7.1

• Microsoft Security Update for Windows Media Player 7.1 for Windows 2000 (KB911565)
  Fix for Microsoft Windows 2000 Service Pack 4.
  http://www.microsoft.com/downloads/details.aspx?familyid=26A0B9E1-1242 -4E55-B3D4-8377B83257C6&displaylang=en

Microsoft Windows Media Player 8.0

• Microsoft Security Update for Windows Media Player 8 for Windows XP (KB911565)
  Fix for Microsoft Windows XP Service Pack 1.
  http://www.microsoft.com/downloads/details.aspx?familyid=110054F2-244D -4036-B98C-E951CBA7E9BA&displaylang=en

Microsoft Windows Media Player 9.0

• Microsoft Security Update for Windows Media Player 9 (KB911565)
  Fix for Microsoft Windows 2000 Service Pack 4 and Windows XP Service Pack 1.
  http://www.microsoft.com/downloads/details.aspx?familyid=8F9EEF16-04F7 -4DA8-A0EF-1797B52D0B4B&displaylang=en


• Microsoft Security Update for Windows Media Player 9 (KB911565)
  Fix for Microsoft Windows Server 2003.
  http://www.microsoft.com/downloads/details.aspx?familyid=8F9EEF16-04F7 -4DA8-A0EF-1797B52D0B4B&displaylang=en


• Microsoft Security Update for Windows Media Player 9 (KB911565)
  Fix for Microsoft Windows XP Service Pack 2.
  http://www.microsoft.com/downloads/details.aspx?familyid=8F9EEF16-04F7 -4DA8-A0EF-1797B52D0B4B&displaylang=en

Microsoft Windows Media Player Bitmap Handling Buffer Overflow Vulnerability

References:

• Microsoft Security Bulletin MS06-005 (Microsoft)
  
• NORTEL RESPONSE TO MICROSOFT SECURITY BULLETIN MS06-005 (Nortel Networks)
  
• [EEYEB-20051017] Windows Media Player BMP Heap Overflow ("eEye Advisories" )