Microsoft: Upgrade Your Media Player

In the company's seventh security bulletin this month, Microsoft has announced two vulnerabilities affecting Windows Media Player 6.4 and 7.0. Users of Windows Media Player 6.4 can download one patch with fixes for both exploits, however a heftier download is needed in order to patch version 7.0. Microsoft recommends that Windows Media Player 7.0 users upgrade to the newest release, 7.1.

In both cases, information must be known about the user's system in order for an attacker to successfully exploit these flaws. Privacy is enhanced when users of Windows Media Player uncheck the option: "Allow Internet sites to uniquely identify your player."

The first issue is a regression of an earlier buffer overrun. This variation of the previous flaw affects code that processes Active Stream Redirector (ASX) files. The component contains an unchecked buffer that can become overwhelmed and allow malicious users to execute the code of their choice on a target machine. According to Microsoft, ASX files allow streaming media to be played from Internet and Intranet sites, and enable the use of playlists.

A second threat stems from the default behavior when Windows Media Player handles Internet shortcuts. These shortcuts are saved to the 'Temporary Files' folder on a system with fixed names. This action changes the Security Zone from Internet to Local Computer Zone, thus allowing greater access to system resources. In Windows 9x and ME, these temporary folders are in a default location for all users. This flaw will allow certain files on a user's hard drive to be read, but not modified or deleted. The attacker would also need to know the exact name of a file in order to obtain access.

Windows Media Player 6.4 users may download a patch for the player, and those running 7.0 should upgrade to version 7.1. For more information the security flaws, visit Microsoft TechNet Security.