search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Windows Media Player does not properly handle PNG images with excessive width or height values

Vulnerability Note VU#259890

Original Release Date: 2005-02-08 | Last Revised: 2005-02-09

Overview

Microsoft Windows Media Player fails to properly handle PNG images containing unexpected information. Remote attackers may be able to craft a malicious PNG image that would cause Media Player to execute arbitrary code.

Description

Microsoft Windows Media Player (WMP) is an application that ships with Microsoft Windows systems. It is used to play various types of media files. WMP will recognize embedded URLs in media files and launch the site specified. According to MS05-009:

A remote code execution vulnerability exists in Windows Media Player because it does not properly handle PNG files with excessive width or height values. An attacker could try to exploit the vulnerability by constructing a malicious PNG that could potentially allow remote code execution if a user visited a malicious Web site or clicked a link in a malicious e-mail message. An attacker who successfully exploited this vulnerability could take complete control of an affected system.

Please refer to Microsoft Security Bulletin MS05-009 for more information regarding this vulnerability and its remediation. In addition, Note that this vulnerability is related to the issues described in VU#817368 or VU#388984.

Impact

If a remote attacker can persuade a user to access a malicious PNG file with Windows Media Player, that attacker may be able to execute arbitrary code.

Solution

Apply Patch


Microsoft has released Microsoft Security Bulletin MS05-009 to address this issue.

Do Not Follow Unsolicited Links

In order to convince users to visit their sites, attackers often use URL encoding, IP address variations, long URLs, intentional misspellings, and other techniques to create misleading links. Do not click on unsolicited links received in email, instant messages, web forums, or internet relay chat (IRC) channels. Type URLs directly into the browser to avoid these misleading links. While these are generally good security practices, following these behaviors will not prevent exploitation of this vulnerability in all cases.

Vendor Information

259890
 
Affected   Unknown   Unaffected

Microsoft Corporation

Updated:  February 08, 2005

Status

  Vulnerable

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see Microsoft Security Bulletin MS05-009.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Acknowledgements

This vulnerability was reported in Microsoft Security Bulletin MS05-009

This document was written by Jeff Gennari based on information provided in Microsoft Security Bulletin MS05-009

Other Information

CVE IDs: CVE-2004-1244
Severity Metric: 8.56
Date Public: 2005-02-08
Date First Published: 2005-02-08
Date Last Updated: 2005-02-09 18:50 UTC
Document Revision: 33

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.