Microsoft Windows Media Player MIDI File Denial of Service Vulnerability

Bugtraq ID:	34585
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Apr 17 2009 12:00AM
Updated:	Apr 17 2009 07:16PM
Credit:	Code Audit Labs
Vulnerable:	Microsoft Windows Media Player 11 Microsoft Windows Media Player 10.0
Not Vulnerable:

Microsoft Windows Media Player MIDI File Denial of Service Vulnerability

Microsoft Windows Media Player is prone to a denial-of-service vulnerability when processing a malformed MIDI file.

A remote attacker can exploit this issue to cause the affected application to enter an infinite loop, denying service to legitimate users.

Microsoft Windows Media Player MIDI File Denial of Service Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to open a maliciously crafted file.

The following exploit is available:

• /data/vulnerabilities/exploits/34585.pl

Microsoft Windows Media Player MIDI File Denial of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft Windows Media Player MIDI File Denial of Service Vulnerability

References:

• Windows Media Player Homepage (Microsoft)