Microsoft Windows Media Player MIDI File MThd Header Parsing Denial of Service Vulnerability

Bugtraq ID:	32077
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2008-4927
Remote:	Yes
Local:	No
Published:	Nov 03 2008 12:00AM
Updated:	May 07 2015 05:22PM
Credit:	Cn4phux
Vulnerable:	Microsoft Windows Media Player 9.0 + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 Web Edition Microsoft Windows Media Player 11 Microsoft Windows Media Player 10.0
Not Vulnerable:

Microsoft Windows Media Player MIDI File MThd Header Parsing Denial of Service Vulnerability

Microsoft Windows Media Player is prone to a denial-of-service vulnerability when processing a malformed MIDI file.

A remote attacker can exploit this issue to crash the affected application, denying service to legitimate users.

Microsoft Windows Media Player MIDI File MThd Header Parsing Denial of Service Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to open a maliciously crafted file.

The following proof-of-concept DAT or MIDI file generator is available:

• /data/vulnerabilities/exploits/32077.py

Microsoft Windows Media Player MIDI File MThd Header Parsing Denial of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft Windows Media Player MIDI File MThd Header Parsing Denial of Service Vulnerability

References:

• Windows Media Player Homepage (Microsoft)