RETIRED: Microsoft Windows Media Player WAV/MID/SND File Parsing Integer Overflow Vulnerability

Bugtraq ID:	33018
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2008-5745
Remote:	Yes
Local:	No
Published:	Dec 25 2008 12:00AM
Updated:	May 12 2015 07:48PM
Credit:	Laurent Gaffie
Vulnerable:	Microsoft Windows Media Player 9.0 + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 Web Edition Microsoft Windows Media Player 11 Microsoft Windows Media Player 10.0
Not Vulnerable:

RETIRED: Microsoft Windows Media Player WAV/MID/SND File Parsing Integer Overflow Vulnerability

Microsoft Windows Media Player is prone to an integer-overflow vulnerability.

An attacker can exploit this issue by tricking an unsuspecting victim into opening a malicious file with the vulnerable application. A successful exploit will result in a crash of the affected application. Arbitrary code execution is not believed to be possible.

NOTE: This BID is being retired because exploits of this issue would have no security impacts.

RETIRED: Microsoft Windows Media Player WAV/MID/SND File Parsing Integer Overflow Vulnerability

The following exploit is available:

• /data/vulnerabilities/exploits/33018-poc.pl

RETIRED: Microsoft Windows Media Player WAV/MID/SND File Parsing Integer Overflow Vulnerability

Solution:
The vendor classifies this issue as a bug with no security implications. The vendor has addressed this issue in Windows Server 2003 SP2; future service packs for other operating systems may also contain updates.

RETIRED: Microsoft Windows Media Player WAV/MID/SND File Parsing Integer Overflow Vulnerability

References:

• Questions about Vulnerability Claim in Windows Media Player (Microsoft)
  
• Windows Media Player crash not exploitable for code execution (Microsoft)
  
• Windows Media Player Homepage (Microsoft)
  
• MS Windows Media Player * (.WAV) Remote Integrer Overflow ([email protected])