Microsoft Windows Media Player K-Lite Codec Pack Memory Corruption Vulnerability

Bugtraq ID:	48263
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Jun 14 2011 12:00AM
Updated:	Jun 14 2011 12:00AM
Credit:	Nicolas Krassas
Vulnerable:	Microsoft Windows Media Player 12 + Microsoft Windows 7 for 32-bit Systems 0 + Microsoft Windows 7 for x64-based Systems 0 + Microsoft Windows 7 Home Premium 0 + Microsoft Windows 7 Professional 0 + Microsoft Windows 7 Starter 0 + Microsoft Windows 7 Ultimate 0
Not Vulnerable:

Microsoft Windows Media Player K-Lite Codec Pack Memory Corruption Vulnerability

Microsoft Windows Media Player is prone to a memory-corruption vulnerability.

Attackers can exploit this issue to cause a denial-of-service condition. Due to the nature of the issue, arbitrary code execution may be possible, but has not been confirmed.

Windows Media Player 12 is vulnerable; other versions may also be affected.

Microsoft Windows Media Player K-Lite Codec Pack Memory Corruption Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to open a malicious file with the affected application.

The following proof-of-concept is available in the below mentioned link:

http://www.deventum.com/research/Crash_WMplayer.3gp

Microsoft Windows Media Player K-Lite Codec Pack Memory Corruption Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft Windows Media Player K-Lite Codec Pack Memory Corruption Vulnerability

References:

• Windows Media Player Homepage (Microsoft)