It looks like there is a fairly serious vulnerability in some of the popular media player packages out in the wild packaged as a MP4 file (due to the MP4 codec from 3ivx), it effects Windows Media Player 6.4 and Windows Media Player Classic, which are made by Microsoft, and AOL’s Winamp version 3.5.
All the more reason to use VLC! This follows fairly shortly after a couple of quite serious vulnerabilities in Quicktime.
Security researchers are warning that popular media players offered by Microsoft and AOL are vulnerable to attacks that can completely compromise a user’s PC.
Attack code has already been released for the bug, which has been confirmed in a codec used by older versions of Windows Media Player, made by Microsoft, and in AOL’s Winamp. A Symantec researcher has warned that users of other players may also be at risk because the vulnerability itself resides in a commonly used MP4 codec produced by a company called 3ivx Technologies.
“The exploit works by supplying victims with a maliciously formed MP4 file,” Raymond Ball wrote for Symantec’s DeepSight Threat Management System. “When a victim unknowingly clicks a link that appears safe, the MP4 content is delivered, causing the exploit to run.”
At least it’s not Microsoft’s fault this time, but they did use a dodgy codec so I guess some of the blame lays with them right?
They could have checked it out properly before bundling it into their software.
A researcher who goes by the name SYS 49152 released exploit code here, here and here that targets Windows Media Player 6.4 and Windows Media Player Classic, which are made by Microsoft, and AOL’s Winamp version 3.5. Each uses the 3ivx MP4 codec, which is vulnerable to a stack overflow.
Secunia describes the Windows Media Player vulnerabilities as “highly critical,” the second-highest rating on Secunia’s five-tier scale. The vulnerability reporting service didn’t have a rating for the Winamp vulnerability.
No patch is available. Ball recommends users remove the codec or disable media players that use the MP4 codec until the hole is plugged. That strikes us as overkill. Taking care not to click on suspicious links in browsers and email programs should suffice.
So watch out, attack vectors are getting more varied – don’t let your guard down during this merry season.
Source: The Register
Subscribe to Darknet RSS Feed Stored in: Exploits/Vulnerabilities, Malware, Windows Hacking
Related Posts:
- Secunia Releases Software Inspector
- Hackers Targeting Xbox Live Players with DoS Attacks
- Microsoft Plugs 11 Serious Flaws in December Update
- New Password Stealing Trojan Targets WoW Players
- Microsoft Breaks Patch Cycle to Issue IE Patch
- Cisco & Microsoft Patch TCP Stack DoS Exploit
| 3,164 views |
Oh dear I feel a wave of : ‘Watch this great movie of my girlfriend/ex/whomever/.. doing something explicit’ emails with attachments coming into my inbox and that of others.
VLC also suffered a vuln sometime ago (http://www.videolan.org/sa0703.html) so it doesn’t seem as impervious as it might seem. Sure I use it, light weight and superb media playback. But as with any software there is the occasional bug/vuln/hole.
Even though my lifelong mantra has been “when unsure, blame Microsoft”, I have to agree with Darknet that M$ can’t really be blamed for this.
On the other hand…. they do facilitate. If their product uses a crappy codec that is vulnerable to a stack overflow, which of course could happen to anyone, that makes them part of the problem. Which makes them partly responsible.
ummmm, how old is that version of windows media player exactly? i think im on version 10 or 11….this goes back to stupid users not updating their software — not microsoft…
Interestingly… I use realplayer… which is a skin for WMP these days, sadly. BUT, it seems not to use the same codecs all the time. Also version 10 of WMP comes with XP… but 6.4 if i’m right shipped with windows ME… which I still prefer, and a lot of home users still run.
yeah but who updates windows media player if they never even use it in the first place … a lot of people still have that version from the first install (including my parents) because they have no need for any version of media player.
now i dont know why this type of user would have a codec problem, but it’s not simply an update issue.
@ cpj
Indeed you might expect no problems if users do not use media player (as such). The bigger problem is websites like YouTube which use the webbrowser to display video and sound through the installed codecs.
This will eventually get people into trouble and will force them to update (without ever actually using WMP) or suffer a breach/hanging Windows XP/Vista.
Eventhough my parents are basic computer and internet users, they are aware of YouTube and browse about for the sheer fun of it (wondering why someone would put such content of him/herself on the www). This is already enough to keep your codecs up to scratch.
@Pantagruel
Good point. Thats why all such sites should use quicktime…
I had never thought of youtube… thank god for running a recent version of XP and having a fairly up-to-date WMP. now i’m off to update a program i dont intentionally use for the first time ever…
@ Nobody_Holme
Even QT sufferes from bug and vuln (have a look at http://secunia.com/advisories/27755/ )
A similar vulnerability is mentioned (http://secunia.com/advisories/26034/) also sporting a ‘crafted’ file
as point of entry. Results range from memory corruption upto arbitrary code execution.
So even here the adagio: ‘Patch, patch and moreover patch’ applies.
Ohhhh… I was expecting an MP4 video broadcast of this news
Apple released a patch for QT 7.3.1 yesterday removing the problems you run into when opening QTL and RTSP.
Get the patch at http://www.apple.com/support/downloads
So, has anyone here actually tried the exploit? Given, I do not normally use those apps, but I would be intrigued to see a hands-on with these vulnerabilities.
@ Sir Henry
I guess most of us are busy doing other stuff (I certainly am), securing machines, applying patches, etc.
But give it a whirl, get vmware (or any other virtual environment) and install a ‘virgin’ version of XP and try the exploits available. We’ll be eager to read your first hand experience. After a look at my ‘to-do’list this exploit most likely will have to wait untill somewhere next week.
I do update my QT… makes life easier. hadnt spotted that latest though. Off i go to download it.
@Pantagruel:
I, too, am within the population of busy bees you described. Should I encounter a free moment today, I shall see what ground I can cover. I will report back with any updates as I have them.
Although this is more the users fault for not updating rather than microsoft, it seems like there should be some security update or alert specifically for people who are vulnerable to this exploit.
Plus, its microsoft… Enough said…