[原文]Buffer overflows in Microsoft Windows Media Player 7 and earlier allow remote attackers to execute arbitrary commands via (1) a long version tag in an .ASX file, or (2) a long banner tag, a variant of the ".ASX Buffer Overrun" vulnerability as discussed in MS:MS00-090.
[CNNVD]Windows Media Player .ASX 'Version'缓冲区溢出漏洞(CNNVD-200106-163)
Microsoft Windows Media Player 7及其早期版本存在目录遍历漏洞。远程攻击者借助(1).ASX文件的超长version标签,或者(2)超长banner标签, 正如在MS:MS00-090讨论的“.ASX缓冲区溢出”漏洞的变体执行任意命令。
Microsoft Windows Media Player 7及其早期版本存在目录遍历漏洞。远程攻击者借助(1).ASX文件的超长version标签,或者(2)超长banner标签, 正如在MS:MS00-090讨论的“.ASX缓冲区溢出”漏洞的变体执行任意命令。
-
公告与补丁
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com .
Discovered and posted to Bugtraq by ByteRage <byterage@yahoo.com> on May 6, 2001.
-
受影响的程序版本
Microsoft Windows Media Player 7.0
-
Microsoft Windows 2000 Professional SP2
-
Microsoft Windows 2000 Professional SP2
-
Microsoft Windows 2000 Professional SP1
-
Microsoft Windows 2000 Professional SP1
-
Microsoft Windows 2000 Professional
-
Microsoft Windows 2000 Professional
-
Microsoft Windows 95
-
Microsoft Windows 95
-
Microsoft Windows 98
-
Microsoft Windows 98
-
Microsoft Windows NT 4.0 SP6a
-
Microsoft Windows NT 4.0 SP6a
-
Microsoft Windows NT 4.0 SP6
-
Microsoft Windows NT 4.0 SP6
-
Microsoft Windows NT 4.0 SP5
-
Microsoft Windows NT 4.0 SP5
-
Microsoft Windows NT 4.0 SP4
-
Microsoft Windows NT 4.0 SP4
-
Microsoft Windows NT 4.0 SP3
-
Microsoft Windows NT 4.0 SP3
-
Microsoft Windows NT 4.0 SP2
-
Microsoft Windows NT 4.0 SP2
-
Microsoft Windows NT 4.0 SP1
-
Microsoft Windows NT 4.0 SP1
-
Microsoft Windows NT 4.0
-
Microsoft Windows NT 4.0
Microsoft Windows Media Player 6.4
-
Microsoft Windows 2000 Professional SP2
-
Microsoft Windows 2000 Professional SP2
-
Microsoft Windows 2000 Professional SP2
-
Microsoft Windows 2000 Professional SP1
-
Microsoft Windows 2000 Professional SP1
-
Microsoft Windows 2000 Professional SP1
-
Microsoft Windows 2000 Professional SP1
-
Microsoft Windows 2000 Professional
-
Microsoft Windows 2000 Professional
-
Microsoft Windows 2000 Professional
-
Microsoft Windows 2000 Professional
-
Microsoft Windows 95
-
Microsoft Windows 95
-
Microsoft Windows 95
-
Microsoft Windows 95
-
Microsoft Windows 98
-
Microsoft Windows 98
-
Microsoft Windows 98
-
Microsoft Windows 98
-
Microsoft Windows NT 4.0 SP6a
-
Microsoft Windows NT 4.0 SP6a
-
Microsoft Windows NT 4.0 SP6a
-
Microsoft Windows NT 4.0 SP6a
-
Microsoft Windows NT 4.0 SP6
-
Microsoft Windows NT 4.0 SP6
-
Microsoft Windows NT 4.0 SP6
-
Microsoft Windows NT 4.0 SP6
-
Microsoft Windows NT 4.0 SP5
-
Microsoft Windows NT 4.0 SP5
-
Microsoft Windows NT 4.0 SP5
-
Microsoft Windows NT 4.0 SP5
-
Microsoft Windows NT 4.0 SP4
-
Microsoft Windows NT 4.0 SP4
-
Microsoft Windows NT 4.0 SP4
-
Microsoft Windows NT 4.0 SP4
-
Microsoft Windows NT 4.0 SP3
-
Microsoft Windows NT 4.0 SP3
-
Microsoft Windows NT 4.0 SP3
-
Microsoft Windows NT 4.0 SP3
-
Microsoft Windows NT 4.0 SP2
-
Microsoft Windows NT 4.0 SP2
-
Microsoft Windows NT 4.0 SP2
-
Microsoft Windows NT 4.0 SP2
-
Microsoft Windows NT 4.0 SP1
-
Microsoft Windows NT 4.0 SP1
-
Microsoft Windows NT 4.0 SP1
-
Microsoft Windows NT 4.0 SP1
-
Microsoft Windows NT 4.0
-
Microsoft Windows NT 4.0
-
Microsoft Windows NT 4.0
-
Microsoft Windows NT 4.0
-
Microsoft Windows Server 2003 SP2
-
Microsoft Windows Server 2003 SP2
-
Microsoft Windows Server 2003 Datacenter x64 Edition SP2
-
Microsoft Windows Server 2003 Datacenter x64 Edition SP2
-
Microsoft Windows Server 2003 Enterprise x64 Edition SP2
-
Microsoft Windows Server 2003 Enterprise x64 Edition SP2
-
Microsoft Windows Server 2003 Standard x64 Edition
-
Microsoft Windows Server 2003 Standard x64 Edition
-
Microsoft Windows Server 2003 x64 SP2
-
Microsoft Windows Server 2003 x64 SP2
-
Microsoft Windows XP Professional x64 Edition SP2
-
Microsoft Windows XP Professional x64 Edition SP2
Microsoft Windows Media Player 6.3
-
Apple Mac OS 7 7.6.1
-
Apple Mac OS 7 7.6.1
-
Apple Mac OS 7 7.6
-
Apple Mac OS 7 7.6
-
Apple Mac OS 7 7.5.3
-
Apple Mac OS 7 7.5.3
-
Apple Mac OS 7 7.5.2
-
Apple Mac OS 7 7.5.2
-
Apple Mac OS 7 7.5.1
-
Apple Mac OS 7 7.5.1
-
Apple Mac OS 7 7.1.2
-
Apple Mac OS 7 7.1.2
-
Apple Mac OS 7 7.1
-
Apple Mac OS 7 7.1
-
Apple Mac OS 7 7.0.1
-
Apple Mac OS 7 7.0.1
-
Apple Mac OS 7 7.0
-
Apple Mac OS 7 7.0
-
Apple Mac OS 8 8.0
-
Apple Mac OS 8 8.0
+
Microsoft Windows 2000 Professional
+
Microsoft Windows 2000 Professional
+
Microsoft Windows 95
+
Microsoft Windows 95
+
Microsoft Windows 98
+
Microsoft Windows 98
+
Microsoft Windows ME
+
Microsoft Windows ME
+
Microsoft Windows NT 4.0
+
Microsoft Windows NT 4.0
-
Sun Solaris 2.5.1
-
Sun Solaris 2.5.1
-
Sun Solaris 8_sparc
-
Sun Solaris 8_sparc
-
Sun Solaris 7.0
-
Sun Solaris 7.0
-
Sun Solaris 2.6
-
Sun Solaris 2.6
-
漏洞讨论
Windows Media Player is an application used for digital audio, and video content viewing. An unsafe buffer copy involving remotely-obtained data exists in the Active Stream Redirector (ASX) component in Windows Media Player.
When parsing .ASX files, the 'HREF' value in the <VERSION> tag is copied into a local variable without bounds checking. As a result, it is possible to cause a stack overrun if this field exceeds the predefined length limits. This vulnerability can be exploited by an attacker to gain access to victim hosts.
Remote attackers may be able to exploit vulnerable clients if a malicious .ASX file is placed on a webserver.
Though not confirmed, it is increasingly likely that there is a single underlying problem with the handling of HREF attributes which is leading to these vulnerabilities. See Bugtraq IDs 1980 and 2677 (links in reference section).
-
漏洞利用
The following exploit was tested on Windows NT 4.0 SP6a and has been provided by Gary O'leary-Steele <GaryO@sec-1.com>:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com <mailto:vuldb@securityfocus.com>.