Microsoft Windows Media Player Malformed PNG Remote Code Execution Vulnerability

Bugtraq ID:	18385
Class:	Boundary Condition Error
CVE:	CVE-2006-0025
Remote:	Yes
Local:	No
Published:	Jun 13 2006 12:00AM
Updated:	Jan 17 2008 04:58PM
Credit:	Greg MacManus is credited with discovery of this vulnerability.
Vulnerable:	Microsoft Windows Media Player XP + Microsoft Windows XP Home + Microsoft Windows XP Professional Microsoft Windows Media Player 9.0 + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 Web Edition Microsoft Windows Media Player 7.1 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 Microsoft Windows Media Player 10.0
Not Vulnerable:

Microsoft Windows Media Player Malformed PNG Remote Code Execution Vulnerability

Microsoft Windows Media Player is prone to a remote code-execution vulnerability. This vulnerability is related to handling of malicious PNG images.

PNG images may be embedded in Windows Media Player skin files. Attackers may be able to exploit this issue by causing the application to load a malicious skin file, which could be hosted on an attacker-controlled web page or through email attachments. If successful, an attacker could execute arbitrary code in the context of the affected user.

Microsoft has stated that web-based attack scenarios are not possible with Media Player 7.1 on Windows 2000 SP4 and Media Player XP on Windows XP SP2. However, a victim may still be affected if they manually download and install a malicious skin file on these platforms.

Microsoft Windows Media Player Malformed PNG Remote Code Execution Vulnerability

A proof-of-concept exploit is available to members of the Immunity Partner's Program:

https://www.immunityinc.com/downloads/immpartners/MS06-024-PoC.wmz.tar.gz

Further reports suggest that exploit code is publicly available and that this issue is being actively exploited in the wild.

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

Microsoft Windows Media Player Malformed PNG Remote Code Execution Vulnerability

Solution:
Microsoft has released a security bulletin and fixes to address this issue.


Microsoft Windows Media Player 7.1

• Microsoft Security Update for Windows Media Player 7.1 for Windows 2000 (KB917734)
  Media Player 7.1 when installed on Windows 2000 Service Pack 4
  http://www.microsoft.com/downloads/details.aspx?familyid=5abb6258-9468 -4188-a178-aa46f100ab61&displaylang=en

Microsoft Windows Media Player 9.0

• Microsoft Security Update for Windows Media Player 9 (KB917734)
  For Microsoft Windows XP Service Pack 2 and Microsoft Windows Server 2003
  http://www.microsoft.com/downloads/details.aspx?familyid=c00be4c3-34ba -4858-90d7-520b7d240e33&displaylang=en


• Microsoft Security Update for Windows Media Player 9 (KB917734)
  Media Player 9 when installed on Windows 2000 Service Pack 4 or Windows XP Service Pack 1
  http://www.microsoft.com/downloads/details.aspx?familyid=c00be4c3-34ba -4858-90d7-520b7d240e33&displaylang=en

Microsoft Windows Media Player XP

• Microsoft Security Update for Windows Media Player 8 for Windows XP (KB917734)
  For XP on Microsoft Windows XP Service Pack 1
  http://www.microsoft.com/downloads/details.aspx?familyid=11372cc0-3da9 -49ad-bb08-1493ce3cd0bd&displaylang=en

Microsoft Windows Media Player 10.0

• Microsoft Security Update for Windows Media Player 10 for Windows XP (KB917734)
  Media Player 10 when installed on Windows XP Service Pack 1 or Windows XP Service Pack 2
  http://www.microsoft.com/downloads/details.aspx?familyid=0f641572-74fd -4281-953f-6f2f12e001e0&displaylang=en


• Microsoft Security Update for Windows Server 2003 (KB917734)
  Microsoft Windows Server 2003 Service Pack 1
  http://www.microsoft.com/downloads/details.aspx?familyid=4f933b0c-7d2d -4049-92da-bbbe97371594&displaylang=en


• Microsoft Security Update for Windows Server 2003 x64 Edition (KB917734)
  Microsoft Windows Server 2003 x64 Edition
  http://www.microsoft.com/downloads/details.aspx?familyid=facc7dfe-9b3b -48dd-a068-5bb9c6b60f87&displaylang=en


• Microsoft Security Update for Windows XP x64 Edition (KB917734)
  Microsoft Windows XP Professional x64 Edition
  http://www.microsoft.com/downloads/details.aspx?familyid=f59065ec-0279 -48ec-ab27-8abca715ac01&displaylang=en

Microsoft Windows Media Player Malformed PNG Remote Code Execution Vulnerability

References:

• Microsoft Security Bulletin MS06-024 (Microsoft)
  
• Windows Media Player Homepage (Microsoft)
  
• iDefense Security Advisory 06.13.06: Windows Media Player PNG Chunk Decoding Sta (labs-no-reply )