Microsoft Windows Media Player CVE-2010-2745 Remote Code Execution Vulnerability

Bugtraq ID:	43772
Class:	Unknown
CVE:	CVE-2010-2745
Remote:	Yes
Local:	No
Published:	Oct 12 2010 12:00AM
Updated:	Oct 15 2010 07:09AM
Credit:	SkyLined of Google Inc.
Vulnerable:	Microsoft Windows Media Player 9.0 + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 Web Edition Microsoft Windows Media Player 12 + Microsoft Windows 7 for 32-bit Systems 0 + Microsoft Windows 7 for x64-based Systems 0 + Microsoft Windows 7 Home Premium 0 + Microsoft Windows 7 Professional 0 + Microsoft Windows 7 Starter 0 + Microsoft Windows 7 Ultimate 0 Microsoft Windows Media Player 11 Microsoft Windows Media Player 10.0 Avaya Messaging Application Server 0 Avaya Meeting Exchange - Webportal 0 Avaya Meeting Exchange - Web Conferencing Server 0 Avaya Meeting Exchange - Streaming Server 0 Avaya Meeting Exchange - Recording Server 0 Avaya Meeting Exchange - Client Registration Server 0 Avaya Communication Server 1000 Telephony Manager 0 Avaya CallPilot 0 Avaya Aura Conferencing Standard
Not Vulnerable:

Microsoft Windows Media Player CVE-2010-2745 Remote Code Execution Vulnerability

Microsoft Windows Media Player is prone to a remote code-execution vulnerability when handling specially crafted media content.

An attacker can exploit this issue by enticing an unsuspecting user to view a malicious webpage.

Successful exploits will allow the attacker to execute arbitrary code in the context of the user running the application, which can compromise the application and possibly the computer.

The issue affects the following:

Windows Media Player 9 series
Windows Media Player 10
Windows Media Player 11
Windows Media Player 12

Microsoft Windows Media Player CVE-2010-2745 Remote Code Execution Vulnerability

The following exploit code is available:

• /data/vulnerabilities/exploits/43772.html

Microsoft Windows Media Player CVE-2010-2745 Remote Code Execution Vulnerability

Solution:
The vendor released an advisory and updates to address this issue. Please see the references for more information.


Microsoft Windows Media Player 11

• Microsoft Windows6.0-KB2378111-x86.msu
  http://www.microsoft.com/downloads/details.aspx?familyid=95E24A63-D21A -4756-A16E-17A977595396


• Microsoft WindowsMedia11-KB2378111-x64-ENU.exe
  Security Update for Windows Media Player 11 for Windows XP X64 Edition (KB2378111)
  http://www.microsoft.com/downloads/details.aspx?familyid=474b5618-dfe6 -40de-b59b-1fd61a05749e


• Microsoft Windows6.0-KB2378111-x64.msu
  http://www.microsoft.com/downloads/details.aspx?familyid=277151A2-B74F -4DA6-8203-E774AF75E44C


• Microsoft WindowsServer2003.WindowsXP-KB2378111-x64-ENU.exe
  http://www.microsoft.com/downloads/details.aspx?familyid=0663E0E8-C5D1 -4CD2-B6D3-FF78FB56BBA1


• Microsoft WindowsXP-WindowsMedia-KB2378111-x86-ENU.exe
  http://www.microsoft.com/downloads/details.aspx?familyid=BBF153E7-E764 -46A0-A33B-81B7288D346C

Microsoft Windows Media Player 12

• Microsoft Windows6.1-KB2378111-x64.msu
  http://www.microsoft.com/downloads/details.aspx?familyid=00176D56-8A93 -4780-96FC-A7AB715E7291


• Microsoft Windows6.1-KB2378111-x86.msu
  http://www.microsoft.com/downloads/details.aspx?familyid=59A2EF36-9C32 -488B-B5B1-30B5BCD83358

Microsoft Windows Media Player 10.0

• Microsoft WindowsServer2003.WindowsXP-KB2378111-x64-ENU.exe
  http://www.microsoft.com/downloads/details.aspx?familyid=0663E0E8-C5D1 -4CD2-B6D3-FF78FB56BBA1


• Microsoft WindowsXP-WindowsMedia-KB2378111-x86-ENU.exe
  http://www.microsoft.com/downloads/details.aspx?familyid=BBF153E7-E764 -46A0-A33B-81B7288D346C


• Microsoft WindowsServer2003-KB2378111-x86-ENU.exe
  http://www.microsoft.com/downloads/details.aspx?familyid=5479FD20-50D1 -447A-8555-A98CE0723F71

Microsoft Windows Media Player 9.0

• Microsoft WindowsXP-WindowsMedia-KB2378111-x86-ENU.exe
  http://www.microsoft.com/downloads/details.aspx?familyid=BBF153E7-E764 -46A0-A33B-81B7288D346C

Microsoft Windows Media Player CVE-2010-2745 Remote Code Execution Vulnerability

References:

• Windows Media Player Homepage (Microsoft)
  
• ASA-2010-287 (Avaya)
  
• Microsoft Security Bulletin MS10-082 (Microsoft)