Microsoft Windows Media Player WAV File Parsing Code Execution Vulnerability

Bugtraq ID:	33042
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Dec 29 2008 12:00AM
Updated:	Dec 30 2008 03:52PM
Credit:	anonymous
Vulnerable:	Microsoft Windows Media Player 9.0 + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 Web Edition Microsoft Windows Media Player 11 Microsoft Windows Media Player 10.0
Not Vulnerable:

Microsoft Windows Media Player WAV File Parsing Code Execution Vulnerability

Microsoft Windows Media Player is prone to a code-execution vulnerability.

An attacker can exploit this issue by tricking an unsuspecting victim into opening a malicious file with the vulnerable application. A successful exploit will allow arbitrary code to run in the context of the user running the application.

Microsoft Windows Media Player WAV File Parsing Code Execution Vulnerability

The following example exploit is available:

• /data/vulnerabilities/exploits/33042.c

Microsoft Windows Media Player WAV File Parsing Code Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft Windows Media Player WAV File Parsing Code Execution Vulnerability

References:

• Windows Media Player Homepage (Microsoft)
  
• hm? new vulnerabilities? wav windows media ([email protected])