11 December 2007 | 5,172 views

Serious Flaw in Popular Media Players from Microsoft and AOL

Check Your Web Security with Acunetix

It looks like there is a fairly serious vulnerability in some of the popular media player packages out in the wild packaged as a MP4 file (due to the MP4 codec from 3ivx), it effects Windows Media Player 6.4 and Windows Media Player Classic, which are made by Microsoft, and AOL’s Winamp version 3.5.

All the more reason to use VLC! This follows fairly shortly after a couple of quite serious vulnerabilities in Quicktime.

Security researchers are warning that popular media players offered by Microsoft and AOL are vulnerable to attacks that can completely compromise a user’s PC.

Attack code has already been released for the bug, which has been confirmed in a codec used by older versions of Windows Media Player, made by Microsoft, and in AOL’s Winamp. A Symantec researcher has warned that users of other players may also be at risk because the vulnerability itself resides in a commonly used MP4 codec produced by a company called 3ivx Technologies.

“The exploit works by supplying victims with a maliciously formed MP4 file,” Raymond Ball wrote for Symantec’s DeepSight Threat Management System. “When a victim unknowingly clicks a link that appears safe, the MP4 content is delivered, causing the exploit to run.”

At least it’s not Microsoft’s fault this time, but they did use a dodgy codec so I guess some of the blame lays with them right?

They could have checked it out properly before bundling it into their software.

A researcher who goes by the name SYS 49152 released exploit code here, here and here that targets Windows Media Player 6.4 and Windows Media Player Classic, which are made by Microsoft, and AOL’s Winamp version 3.5. Each uses the 3ivx MP4 codec, which is vulnerable to a stack overflow.

Secunia describes the Windows Media Player vulnerabilities as “highly critical,” the second-highest rating on Secunia’s five-tier scale. The vulnerability reporting service didn’t have a rating for the Winamp vulnerability.

No patch is available. Ball recommends users remove the codec or disable media players that use the MP4 codec until the hole is plugged. That strikes us as overkill. Taking care not to click on suspicious links in browsers and email programs should suffice.

So watch out, attack vectors are getting more varied – don’t let your guard down during this merry season.

Source: The Register



Recent in Exploits/Vulnerabilities:
- Twitter Bug Bounty Official – Started Paying For Bugs
- Heartbleed Implicated In US Hospital Leak
- XML Quadratic Blowup Attack Blows Up WordPress & Drupal

Related Posts:
- Secunia Releases Software Inspector
- Hackers Targeting Xbox Live Players with DoS Attacks
- New Password Stealing Trojan Targets WoW Players

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 227,455 views
- AJAX: Is your application secure enough? - 119,104 views
- eEye Launches 0-Day Exploit Tracker - 85,056 views

Low-cost VPS Hosting

15 Responses to “Serious Flaw in Popular Media Players from Microsoft and AOL”

  1. Pantagruel 11 December 2007 at 9:31 pm Permalink

    Oh dear I feel a wave of : ‘Watch this great movie of my girlfriend/ex/whomever/.. doing something explicit’ emails with attachments coming into my inbox and that of others.

    VLC also suffered a vuln sometime ago (http://www.videolan.org/sa0703.html) so it doesn’t seem as impervious as it might seem. Sure I use it, light weight and superb media playback. But as with any software there is the occasional bug/vuln/hole.

  2. goodpeople 11 December 2007 at 11:41 pm Permalink

    Even though my lifelong mantra has been “when unsure, blame Microsoft”, I have to agree with Darknet that M$ can’t really be blamed for this.

    On the other hand…. they do facilitate. If their product uses a crappy codec that is vulnerable to a stack overflow, which of course could happen to anyone, that makes them part of the problem. Which makes them partly responsible.

  3. ummmm 12 December 2007 at 2:23 pm Permalink

    ummmm, how old is that version of windows media player exactly? i think im on version 10 or 11….this goes back to stupid users not updating their software — not microsoft…

  4. Nobody_Holme 12 December 2007 at 3:06 pm Permalink

    Interestingly… I use realplayer… which is a skin for WMP these days, sadly. BUT, it seems not to use the same codecs all the time. Also version 10 of WMP comes with XP… but 6.4 if i’m right shipped with windows ME… which I still prefer, and a lot of home users still run.

  5. cpj 13 December 2007 at 1:29 am Permalink

    yeah but who updates windows media player if they never even use it in the first place … a lot of people still have that version from the first install (including my parents) because they have no need for any version of media player.

    now i dont know why this type of user would have a codec problem, but it’s not simply an update issue.

  6. Pantagruel 13 December 2007 at 11:21 am Permalink

    @ cpj

    Indeed you might expect no problems if users do not use media player (as such). The bigger problem is websites like YouTube which use the webbrowser to display video and sound through the installed codecs.
    This will eventually get people into trouble and will force them to update (without ever actually using WMP) or suffer a breach/hanging Windows XP/Vista.
    Eventhough my parents are basic computer and internet users, they are aware of YouTube and browse about for the sheer fun of it (wondering why someone would put such content of him/herself on the www). This is already enough to keep your codecs up to scratch.

  7. Nobody_Holme 13 December 2007 at 2:49 pm Permalink

    @Pantagruel
    Good point. Thats why all such sites should use quicktime…
    I had never thought of youtube… thank god for running a recent version of XP and having a fairly up-to-date WMP. now i’m off to update a program i dont intentionally use for the first time ever…

  8. Pantagruel 13 December 2007 at 3:27 pm Permalink

    @ Nobody_Holme

    Even QT sufferes from bug and vuln (have a look at http://secunia.com/advisories/27755/ )

    A similar vulnerability is mentioned (http://secunia.com/advisories/26034/) also sporting a ‘crafted’ file
    as point of entry. Results range from memory corruption upto arbitrary code execution.

    So even here the adagio: ‘Patch, patch and moreover patch’ applies.

  9. sKreeM 13 December 2007 at 7:42 pm Permalink

    Ohhhh… I was expecting an MP4 video broadcast of this news

  10. Pantagruel 14 December 2007 at 12:55 pm Permalink

    Apple released a patch for QT 7.3.1 yesterday removing the problems you run into when opening QTL and RTSP.
    Get the patch at http://www.apple.com/support/downloads

  11. Sir Henry 14 December 2007 at 2:07 pm Permalink

    So, has anyone here actually tried the exploit? Given, I do not normally use those apps, but I would be intrigued to see a hands-on with these vulnerabilities.

  12. Pantagruel 14 December 2007 at 2:59 pm Permalink

    @ Sir Henry

    I guess most of us are busy doing other stuff (I certainly am), securing machines, applying patches, etc.
    But give it a whirl, get vmware (or any other virtual environment) and install a ‘virgin’ version of XP and try the exploits available. We’ll be eager to read your first hand experience. After a look at my ‘to-do’list this exploit most likely will have to wait untill somewhere next week.

  13. Nobody_Holme 14 December 2007 at 3:11 pm Permalink

    I do update my QT… makes life easier. hadnt spotted that latest though. Off i go to download it.

  14. Sir Henry 14 December 2007 at 4:49 pm Permalink

    @Pantagruel:

    I, too, am within the population of busy bees you described. Should I encounter a free moment today, I shall see what ground I can cover. I will report back with any updates as I have them.

  15. eM3rC 6 January 2008 at 10:16 pm Permalink

    Although this is more the users fault for not updating rather than microsoft, it seems like there should be some security update or alert specifically for people who are vulnerable to this exploit.

    Plus, its microsoft… Enough said…