CVE-2001-0242
CVSS7.5
 发布时间 :2001-06-27 00:00:00
修订时间 :2017-07-10 21:29:03
NMCOS    

[原文]Buffer overflows in Microsoft Windows Media Player 7 and earlier allow remote attackers to execute arbitrary commands via (1) a long version tag in an .ASX file, or (2) a long banner tag, a variant of the ".ASX Buffer Overrun" vulnerability as discussed in MS:MS00-090.

[CNNVD]Windows Media Player .ASX 'Version'缓冲区溢出漏洞(CNNVD-200106-163)

        Microsoft Windows Media Player 7及其早期版本存在目录遍历漏洞。远程攻击者借助(1).ASX文件的超长version标签，或者(2)超长banner标签， 正如在MS:MS00-090讨论的“.ASX缓冲区溢出”漏洞的变体执行任意命令。

- CVSS (基础分值)

CVSS分值: 7.5 [严重(HIGH)]
机密性影响: [--]
完整性影响: [--]
可用性影响: [--]
攻击复杂度: [--]
攻击向量: [--]
身份认证: [--]

- CPE (受影响的平台与产品)

cpe:/a:microsoft:windows_media_player:6.3Microsoft windows_media_player 6.3
cpe:/a:microsoft:windows_media_player:7Microsoft windows_media_player 7
cpe:/a:microsoft:windows_media_player:6.4Microsoft windows_media_player 6.4

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0242
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2001-0242
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200106-163
(官方数据源) CNNVD

- 其它链接及资源

http://www.kb.cert.org/vuls/id/187528
(UNKNOWN)  CERT-VN  VU#187528
http://www.microsoft.com/technet/security/bulletin/ms01-029.asp
(VENDOR_ADVISORY)  MS  MS01-029
http://www.securityfocus.com/archive/1/181419
(UNKNOWN)  BUGTRAQ  20010502 Microsoft Media Player ASX Parser buffer overflow vulnerability
http://www.securityfocus.com/archive/1/183906
(UNKNOWN)  BUGTRAQ  20010506 Re: Microsoft Media Player ASX Parser buffer overflow vulnerability
http://www.securityfocus.com/bid/2677
(VENDOR_ADVISORY)  BID  2677
http://www.securityfocus.com/bid/2686
(UNKNOWN)  BID  2686
https://exchange.xforce.ibmcloud.com/vulnerabilities/5574
(UNKNOWN)  XF  mediaplayer-asx-bo(5574)

- 漏洞信息

Windows Media Player .ASX 'Version'缓冲区溢出漏洞
高危 缓冲区溢出
2001-06-27 00:00:00 2005-10-20 00:00:00
远程  
        Microsoft Windows Media Player 7及其早期版本存在目录遍历漏洞。远程攻击者借助(1).ASX文件的超长version标签，或者(2)超长banner标签， 正如在MS:MS00-090讨论的“.ASX缓冲区溢出”漏洞的变体执行任意命令。

- 公告与补丁

        Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com .

- 漏洞信息

13476
Microsoft Windows Media Player asx Parser Multiple Tag Overflow
Input Manipulation
Loss of Integrity

- 漏洞描述

Unknown or Incomplete

- 时间线

2000-11-23 Unknow
Unknow Unknow

- 解决方案

Unknown or Incomplete

- 相关参考

- 漏洞作者

Unknown or Incomplete

- 漏洞信息

Windows Media Player .ASX 'Version' Buffer Overflow Vulnerability
Boundary Condition Error 2686
Yes No
2001-05-06 12:00:00 2009-07-11 06:06:00
Discovered and posted to Bugtraq by ByteRage <byterage@yahoo.com> on May 6, 2001.

- 受影响的程序版本

Microsoft Windows Media Player 7.0
- Microsoft Windows 2000 Professional SP2
 - Microsoft Windows 2000 Professional SP2
 - Microsoft Windows 2000 Professional SP1
 - Microsoft Windows 2000 Professional SP1
 - Microsoft Windows 2000 Professional
- Microsoft Windows 2000 Professional
- Microsoft Windows 95
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows 98
- Microsoft Windows NT 4.0 SP6a
 - Microsoft Windows NT 4.0 SP6a
 - Microsoft Windows NT 4.0 SP6
 - Microsoft Windows NT 4.0 SP6
 - Microsoft Windows NT 4.0 SP5
 - Microsoft Windows NT 4.0 SP5
 - Microsoft Windows NT 4.0 SP4
 - Microsoft Windows NT 4.0 SP4
 - Microsoft Windows NT 4.0 SP3
 - Microsoft Windows NT 4.0 SP3
 - Microsoft Windows NT 4.0 SP2
 - Microsoft Windows NT 4.0 SP2
 - Microsoft Windows NT 4.0 SP1
 - Microsoft Windows NT 4.0 SP1
 - Microsoft Windows NT 4.0
 - Microsoft Windows NT 4.0
 Microsoft Windows Media Player 6.4
- Microsoft Windows 2000 Professional SP2
 - Microsoft Windows 2000 Professional SP2
 - Microsoft Windows 2000 Professional SP2
 - Microsoft Windows 2000 Professional SP1
 - Microsoft Windows 2000 Professional SP1
 - Microsoft Windows 2000 Professional SP1
 - Microsoft Windows 2000 Professional SP1
 - Microsoft Windows 2000 Professional
- Microsoft Windows 2000 Professional
- Microsoft Windows 2000 Professional
- Microsoft Windows 2000 Professional
- Microsoft Windows 95
- Microsoft Windows 95
- Microsoft Windows 95
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows 98
- Microsoft Windows 98
- Microsoft Windows 98
- Microsoft Windows NT 4.0 SP6a
 - Microsoft Windows NT 4.0 SP6a
 - Microsoft Windows NT 4.0 SP6a
 - Microsoft Windows NT 4.0 SP6a
 - Microsoft Windows NT 4.0 SP6
 - Microsoft Windows NT 4.0 SP6
 - Microsoft Windows NT 4.0 SP6
 - Microsoft Windows NT 4.0 SP6
 - Microsoft Windows NT 4.0 SP5
 - Microsoft Windows NT 4.0 SP5
 - Microsoft Windows NT 4.0 SP5
 - Microsoft Windows NT 4.0 SP5
 - Microsoft Windows NT 4.0 SP4
 - Microsoft Windows NT 4.0 SP4
 - Microsoft Windows NT 4.0 SP4
 - Microsoft Windows NT 4.0 SP4
 - Microsoft Windows NT 4.0 SP3
 - Microsoft Windows NT 4.0 SP3
 - Microsoft Windows NT 4.0 SP3
 - Microsoft Windows NT 4.0 SP3
 - Microsoft Windows NT 4.0 SP2
 - Microsoft Windows NT 4.0 SP2
 - Microsoft Windows NT 4.0 SP2
 - Microsoft Windows NT 4.0 SP2
 - Microsoft Windows NT 4.0 SP1
 - Microsoft Windows NT 4.0 SP1
 - Microsoft Windows NT 4.0 SP1
 - Microsoft Windows NT 4.0 SP1
 - Microsoft Windows NT 4.0
 - Microsoft Windows NT 4.0
 - Microsoft Windows NT 4.0
 - Microsoft Windows NT 4.0
 - Microsoft Windows Server 2003 SP2
 - Microsoft Windows Server 2003 SP2
 - Microsoft Windows Server 2003 Datacenter x64 Edition SP2
 - Microsoft Windows Server 2003 Datacenter x64 Edition SP2
 - Microsoft Windows Server 2003 Enterprise x64 Edition SP2
 - Microsoft Windows Server 2003 Enterprise x64 Edition SP2
 - Microsoft Windows Server 2003 Standard x64 Edition
- Microsoft Windows Server 2003 Standard x64 Edition
- Microsoft Windows Server 2003 x64 SP2
 - Microsoft Windows Server 2003 x64 SP2
 - Microsoft Windows XP Professional x64 Edition SP2
 - Microsoft Windows XP Professional x64 Edition SP2
 Microsoft Windows Media Player 6.3
- Apple Mac OS 7 7.6.1
- Apple Mac OS 7 7.6.1
- Apple Mac OS 7 7.6
- Apple Mac OS 7 7.6
- Apple Mac OS 7 7.5.3
- Apple Mac OS 7 7.5.3
- Apple Mac OS 7 7.5.2
- Apple Mac OS 7 7.5.2
- Apple Mac OS 7 7.5.1
- Apple Mac OS 7 7.5.1
- Apple Mac OS 7 7.1.2
- Apple Mac OS 7 7.1.2
- Apple Mac OS 7 7.1
- Apple Mac OS 7 7.1
- Apple Mac OS 7 7.0.1
- Apple Mac OS 7 7.0.1
- Apple Mac OS 7 7.0
- Apple Mac OS 7 7.0
- Apple Mac OS 8 8.0
- Apple Mac OS 8 8.0
+ Microsoft Windows 2000 Professional
+ Microsoft Windows 2000 Professional
+ Microsoft Windows 95
+ Microsoft Windows 95
+ Microsoft Windows 98
+ Microsoft Windows 98
+ Microsoft Windows ME
+ Microsoft Windows ME
+ Microsoft Windows NT 4.0
 + Microsoft Windows NT 4.0
 - Sun Solaris 2.5.1
- Sun Solaris 2.5.1
- Sun Solaris 8_sparc
 - Sun Solaris 8_sparc
 - Sun Solaris 7.0
 - Sun Solaris 7.0
 - Sun Solaris 2.6
 - Sun Solaris 2.6

- 漏洞讨论

Windows Media Player is an application used for digital audio, and video content viewing. An unsafe buffer copy involving remotely-obtained data exists in the Active Stream Redirector (ASX) component in Windows Media Player.

When parsing .ASX files, the 'HREF' value in the &lt;VERSION&gt; tag is copied into a local variable without bounds checking. As a result, it is possible to cause a stack overrun if this field exceeds the predefined length limits. This vulnerability can be exploited by an attacker to gain access to victim hosts.

Remote attackers may be able to exploit vulnerable clients if a malicious .ASX file is placed on a webserver.

Though not confirmed, it is increasingly likely that there is a single underlying problem with the handling of HREF attributes which is leading to these vulnerabilities. See Bugtraq IDs 1980 and 2677 (links in reference section).

- 漏洞利用

The following exploit was tested on Windows NT 4.0 SP6a and has been provided by Gary O'leary-Steele &lt;GaryO@sec-1.com&gt;:

- 解决方案

Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com <mailto:vuldb@securityfocus.com>.

- 相关参考

 

 

CVE数据库

检索CVE



关于CVE

CVE资源

Wise Words

image 这世界并不会在意你的自尊。这世界指望你在自我感觉良好之前先要有所成就。image

-- 比尔·盖茨

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息，请查阅[关于本站]。

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标，它们的官方数据源均保存在MITRE公司的相关网站。
© Copyright 2014 @evan-css. CCERT.

京ICP备14000297号-2