Serious Flaw in Popular Media Players from Microsoft and AOL

It looks like there is a fairly serious vulnerability in some of the popular media player packages out in the wild packaged as a MP4 file (due to the MP4 codec from 3ivx), it effects Windows Media Player 6.4 and Windows Media Player Classic, which are made by Microsoft, and AOL’s Winamp version 3.5.

All the more reason to use VLC! This follows fairly shortly after a couple of quite serious vulnerabilities in Quicktime.

Security researchers are warning that popular media players offered by Microsoft and AOL are vulnerable to attacks that can completely compromise a user’s PC.

Attack code has already been released for the bug, which has been confirmed in a codec used by older versions of Windows Media Player, made by Microsoft, and in AOL’s Winamp. A Symantec researcher has warned that users of other players may also be at risk because the vulnerability itself resides in a commonly used MP4 codec produced by a company called 3ivx Technologies.

“The exploit works by supplying victims with a maliciously formed MP4 file,” Raymond Ball wrote for Symantec’s DeepSight Threat Management System. “When a victim unknowingly clicks a link that appears safe, the MP4 content is delivered, causing the exploit to run.”

At least it’s not Microsoft’s fault this time, but they did use a dodgy codec so I guess some of the blame lays with them right?

They could have checked it out properly before bundling it into their software.

A researcher who goes by the name SYS 49152 released exploit code here, here and here that targets Windows Media Player 6.4 and Windows Media Player Classic, which are made by Microsoft, and AOL’s Winamp version 3.5. Each uses the 3ivx MP4 codec, which is vulnerable to a stack overflow.

Secunia describes the Windows Media Player vulnerabilities as “highly critical,” the second-highest rating on Secunia’s five-tier scale. The vulnerability reporting service didn’t have a rating for the Winamp vulnerability.

No patch is available. Ball recommends users remove the codec or disable media players that use the MP4 codec until the hole is plugged. That strikes us as overkill. Taking care not to click on suspicious links in browsers and email programs should suffice.

So watch out, attack vectors are getting more varied – don’t let your guard down during this merry season.

Source: The Register

Posted in: Exploits/Vulnerabilities, Malware, Windows Hacking

, , , ,

Latest Posts:

GKE Auditor - Detect Google Kubernetes Engine Misconfigurations GKE Auditor – Detect Google Kubernetes Engine Misconfigurations
GKE Auditor is a Java-based tool to detect Google Kubernetes Engine misconfigurations, it aims to help security & dev teams streamline the configuration process
zANTI - Android Wireless Hacking Tool Free Download zANTI – Android Wireless Hacking Tool Free Download
zANTI is an Android Wireless Hacking Tool that functions as a mobile penetration testing toolkit that lets you assess the risk level of a network using mobile.
HELK - Open Source Threat Hunting Platform HELK – Open Source Threat Hunting Platform
The Hunting ELK or simply the HELK is an Open-Source Threat Hunting Platform with advanced analytics capabilities such as SQL declarative language, graphing etc
trape - OSINT Analysis Tool For People Tracking Trape – OSINT Analysis Tool For People Tracking
Trape is an OSINT analysis tool, which allows people to track and execute intelligent social engineering attacks in real-time.
Fuzzilli - JavaScript Engine Fuzzing Library Fuzzilli – JavaScript Engine Fuzzing Library
Fuzzilii is a JavaScript engine fuzzing library, it's a coverage-guided fuzzer for dynamic language interpreters based on a custom intermediate language.
OWASP APICheck - HTTP API DevSecOps Toolset OWASP APICheck – HTTP API DevSecOps Toolset
APICheck is an HTTP API DevSecOps toolset, it integrates existing tools, creates execution chains easily and is designed for integration with 3rd parties.

15 Responses to Serious Flaw in Popular Media Players from Microsoft and AOL

  1. Pantagruel December 11, 2007 at 9:31 pm #

    Oh dear I feel a wave of : ‘Watch this great movie of my girlfriend/ex/whomever/.. doing something explicit’ emails with attachments coming into my inbox and that of others.

    VLC also suffered a vuln sometime ago ( so it doesn’t seem as impervious as it might seem. Sure I use it, light weight and superb media playback. But as with any software there is the occasional bug/vuln/hole.

  2. goodpeople December 11, 2007 at 11:41 pm #

    Even though my lifelong mantra has been “when unsure, blame Microsoft”, I have to agree with Darknet that M$ can’t really be blamed for this.

    On the other hand…. they do facilitate. If their product uses a crappy codec that is vulnerable to a stack overflow, which of course could happen to anyone, that makes them part of the problem. Which makes them partly responsible.

  3. ummmm December 12, 2007 at 2:23 pm #

    ummmm, how old is that version of windows media player exactly? i think im on version 10 or 11….this goes back to stupid users not updating their software — not microsoft…

  4. Nobody_Holme December 12, 2007 at 3:06 pm #

    Interestingly… I use realplayer… which is a skin for WMP these days, sadly. BUT, it seems not to use the same codecs all the time. Also version 10 of WMP comes with XP… but 6.4 if i’m right shipped with windows ME… which I still prefer, and a lot of home users still run.

  5. cpj December 13, 2007 at 1:29 am #

    yeah but who updates windows media player if they never even use it in the first place … a lot of people still have that version from the first install (including my parents) because they have no need for any version of media player.

    now i dont know why this type of user would have a codec problem, but it’s not simply an update issue.

  6. Pantagruel December 13, 2007 at 11:21 am #

    @ cpj

    Indeed you might expect no problems if users do not use media player (as such). The bigger problem is websites like YouTube which use the webbrowser to display video and sound through the installed codecs.
    This will eventually get people into trouble and will force them to update (without ever actually using WMP) or suffer a breach/hanging Windows XP/Vista.
    Eventhough my parents are basic computer and internet users, they are aware of YouTube and browse about for the sheer fun of it (wondering why someone would put such content of him/herself on the www). This is already enough to keep your codecs up to scratch.

  7. Nobody_Holme December 13, 2007 at 2:49 pm #

    Good point. Thats why all such sites should use quicktime…
    I had never thought of youtube… thank god for running a recent version of XP and having a fairly up-to-date WMP. now i’m off to update a program i dont intentionally use for the first time ever…

  8. Pantagruel December 13, 2007 at 3:27 pm #

    @ Nobody_Holme

    Even QT sufferes from bug and vuln (have a look at )

    A similar vulnerability is mentioned ( also sporting a ‘crafted’ file
    as point of entry. Results range from memory corruption upto arbitrary code execution.

    So even here the adagio: ‘Patch, patch and moreover patch’ applies.

  9. sKreeM December 13, 2007 at 7:42 pm #

    Ohhhh… I was expecting an MP4 video broadcast of this news

  10. Pantagruel December 14, 2007 at 12:55 pm #

    Apple released a patch for QT 7.3.1 yesterday removing the problems you run into when opening QTL and RTSP.
    Get the patch at

  11. Sir Henry December 14, 2007 at 2:07 pm #

    So, has anyone here actually tried the exploit? Given, I do not normally use those apps, but I would be intrigued to see a hands-on with these vulnerabilities.

  12. Pantagruel December 14, 2007 at 2:59 pm #

    @ Sir Henry

    I guess most of us are busy doing other stuff (I certainly am), securing machines, applying patches, etc.
    But give it a whirl, get vmware (or any other virtual environment) and install a ‘virgin’ version of XP and try the exploits available. We’ll be eager to read your first hand experience. After a look at my ‘to-do’list this exploit most likely will have to wait untill somewhere next week.

  13. Nobody_Holme December 14, 2007 at 3:11 pm #

    I do update my QT… makes life easier. hadnt spotted that latest though. Off i go to download it.

  14. Sir Henry December 14, 2007 at 4:49 pm #


    I, too, am within the population of busy bees you described. Should I encounter a free moment today, I shall see what ground I can cover. I will report back with any updates as I have them.

  15. eM3rC January 6, 2008 at 10:16 pm #

    Although this is more the users fault for not updating rather than microsoft, it seems like there should be some security update or alert specifically for people who are vulnerable to this exploit.

    Plus, its microsoft… Enough said…