BID:5107

Windows Media Player IE Cache Path Disclosure Vulnerability

Info

Windows Media Player IE Cache Path Disclosure Vulnerability

Bugtraq ID:	5107
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Jun 26 2002 12:00AM
Updated:	Jun 26 2002 12:00AM
Credit:	Microsoft credits jelmer for the discovery of this vulnerability.
Vulnerable:	Microsoft Windows Media Player XP + Microsoft Windows XP Home + Microsoft Windows XP Professional Microsoft Windows Media Player 7.1 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 Microsoft Windows Media Player 6.4 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Microsoft Windows Server 2003 SP2 - Microsoft Windows Server 2003 SP2 - Microsoft Windows Server 2003 Datacenter x64 Edition SP2 - Microsoft Windows Server 2003 Datacenter x64 Edition SP2 - Microsoft Windows Server 2003 Enterprise x64 Edition SP2 - Microsoft Windows Server 2003 Enterprise x64 Edition SP2 - Microsoft Windows Server 2003 Standard x64 Edition - Microsoft Windows Server 2003 Standard x64 Edition - Microsoft Windows Server 2003 x64 SP2 - Microsoft Windows Server 2003 x64 SP2 - Microsoft Windows XP Professional x64 Edition SP2 - Microsoft Windows XP Professional x64 Edition SP2

Not Vulnerable:

Discussion

Windows Media Player IE Cache Path Disclosure Vulnerability

Microsoft Windows Media Player is distributed with multiple versions of the Microsoft Windows Operating System. A vulnerability has been reported that affects systems using Windows Media Player 6.4, 7.1, or Media Player for Windows XP.

An information disclosure vulnerability that may also allow an attacker the opportunity to execute arbitrary code on the targetted system has been reported. This vulnerability occurs due to the handling of license files for secure media files that are stored in the IE cache. The flaw affects only secure media files which use WM DRM 1.0. The risk for code execution is due to Windows Media Player disclosing the location of the IE cache, which uses a obfuscated name. An attacker that is able to learn the location of the cache can use scripting to execute a file located in the cache and it will be treated as part of the Local Computer Zone.

** There have been reports that the updated patch for this issue does not install properly on Windows 2000 systems. Microsoft has not confirmed or denied these reports.

Exploit / POC

Windows Media Player IE Cache Path Disclosure Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.