BID:16644

Microsoft Windows Media Player Plugin Buffer Overflow Vulnerability

Info

Microsoft Windows Media Player Plugin Buffer Overflow Vulnerability

Bugtraq ID:	16644
Class:	Boundary Condition Error
CVE:	CVE-2006-0005
Remote:	Yes
Local:	No
Published:	Feb 14 2006 12:00AM
Updated:	May 15 2007 08:48PM
Credit:	John Cobb of iDEFENSE is credited with the discovery of this vulnerability. This issue was disclosed in the referenced vendor advisory.
Vulnerable:	Microsoft Windows XP Tablet PC Edition SP2 Microsoft Windows XP Tablet PC Edition SP1 Microsoft Windows XP Tablet PC Edition Microsoft Windows XP Professional x64 Edition Microsoft Windows XP Professional SP2 Microsoft Windows XP Professional SP1 Microsoft Windows XP Professional Microsoft Windows XP Media Center Edition SP2 Microsoft Windows XP Media Center Edition SP1 Microsoft Windows XP Media Center Edition Microsoft Windows XP Home SP2 Microsoft Windows XP Home SP1 Microsoft Windows XP Home Microsoft Windows XP 0 Microsoft Windows Server 2003 Web Edition SP1 Microsoft Windows Server 2003 Web Edition Microsoft Windows Server 2003 Standard x64 Edition Microsoft Windows Server 2003 Standard Edition SP1 Microsoft Windows Server 2003 Standard Edition Microsoft Windows Server 2003 Enterprise x64 Edition Microsoft Windows Server 2003 Enterprise Edition SP1 Microsoft Windows Server 2003 Enterprise Edition Microsoft Windows Server 2003 Datacenter x64 Edition Microsoft Windows Server 2003 Datacenter Edition SP1 Microsoft Windows Server 2003 Datacenter Edition Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Server SP3 Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Server + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 Microsoft Windows 2000 Professional SP4 Microsoft Windows 2000 Professional SP3 Microsoft Windows 2000 Professional SP2 Microsoft Windows 2000 Professional SP1 Microsoft Windows 2000 Professional Microsoft Windows 2000 Datacenter Server SP4 Microsoft Windows 2000 Datacenter Server SP3 Microsoft Windows 2000 Datacenter Server SP2 Microsoft Windows 2000 Datacenter Server SP1 Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Advanced Server SP4 Microsoft Windows 2000 Advanced Server SP3 Microsoft Windows 2000 Advanced Server SP2 Microsoft Windows 2000 Advanced Server SP1 Microsoft Windows 2000 Advanced Server

Not Vulnerable:

Discussion

Microsoft Windows Media Player Plugin Buffer Overflow Vulnerability

The Microsoft Windows Media Player plugin for non-Microsoft browsers is prone to a buffer-overflow vulnerability. The application fails to do proper boundary checks on user-supplied data before using it in a finite-sized buffer.

An attacker can exploit this issue to execute arbitrary code on the victim user's computer in the context of the victim user. This may facilitate a compromise of the affected computer.

This issue is exploitable only through non-Microsoft browsers that have the Media Player plugin installed. Possible browsers include Firefox .9 and later and Netscape 8; other browsers with the plugin installed may also be affected.

Exploit / POC

Microsoft Windows Media Player Plugin Buffer Overflow Vulnerability

UPDATE (May 15, 2007): This issue is being exploited by the MPack hacker tool. Please see the references for more information.

NOTE: Mozilla Firefox and Opera Browser (and possibly other browsers) are a valid attack vector for this issue.

The following exploits are available:

/data/vulnerabilities/exploits/WMPEmbed.html
/data/vulnerabilities/exploits/wmp_plugin_ms06_006.pm
/data/vulnerabilities/exploits/wmp-profiteer.pl

Solution / Fix

Microsoft Windows Media Player Plugin Buffer Overflow Vulnerability

Solution:
Microsoft has released security advisory MS06-006 with updates to address this issue.

Microsoft Windows Server 2003 Datacenter Edition SP1