[security-alerts] FW: [SA20626] Windows Media Player PNG Processing Buffer Overflow

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> 
> TITLE:
> Windows Media Player PNG Processing Buffer Overflow
> 
> SECUNIA ADVISORY ID:
> SA20626
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/20626/
> 
> CRITICAL:
> Highly critical
> 
> IMPACT:
> System access
> 
> WHERE:
> From remote
> 
> SOFTWARE:
> Microsoft Windows Media Player 10.x
> http://secunia.com/product/4208/
> Microsoft Windows Media Player 7.x
> http://secunia.com/product/1084/
> Microsoft Windows Media Player 9.x
> http://secunia.com/product/1085/
> 
> DESCRIPTION:
> iDefense Labs has reported a vulnerability in Windows Media Player,
> which can be exploited by malicious people to compromise a user's
> system.
> 
> The vulnerability is caused due to a boundary error within the
> decoding of PNG (Portable Network Graphics) image file chunks. This
> can be exploited to cause a stack-based buffer overflow via a
> specially crafted PNG image when a user opens a malicious WMZ file or
> visits a malicious web site.
> 
> Successful exploitation allows execution of arbitrary code.
> 
> SOLUTION:
> Apply patches.
> 
> Windows Media Player for XP on Windows XP SP1:
> http://www.microsoft.com/downloads/details.aspx?FamilyId=11372
> cc0-3da9-49ad-bb08-1493ce3cd0bd
> 
> Windows Media Player 9 on Windows XP SP2:
> http://www.microsoft.com/downloads/details.aspx?FamilyId=c00be
> 4c3-34ba-4858-90d7-520b7d240e33
> 
> Windows Media Player 10 on Windows XP Professional x64 Edition:
> http://www.microsoft.com/downloads/details.aspx?FamilyId=f5906
> 5ec-0279-48ec-ab27-8abca715ac01
> 
> Windows Media Player 9 on Windows Server 2003:
> http://www.microsoft.com/downloads/details.aspx?FamilyId=c00be
> 4c3-34ba-4858-90d7-520b7d240e33
> 
> Windows Media Player 10 on Windows Server 2003 SP1:
> http://www.microsoft.com/downloads/details.aspx?FamilyId=4f933
> b0c-7d2d-4049-92da-bbbe97371594
> 
> Windows Media Player 10 on Windows Server 2003 x64 Edition:
> http://www.microsoft.com/downloads/details.aspx?FamilyId=facc7
> dfe-9b3b-48dd-a068-5bb9c6b60f87
> 
> Windows 98, Windows 98 SE, and Windows Me:
> Patches are available from the Windows Update web site.
> 
> Windows Media Player 7.1 on Windows 2000 SP4:
> http://www.microsoft.com/downloads/details.aspx?FamilyId=5abb6
> 258-9468-4188-a178-aa46f100ab61
> 
> Windows Media Player 9 on Windows 2000 SP4 / Windows XP SP1:
> http://www.microsoft.com/downloads/details.aspx?FamilyId=c00be
> 4c3-34ba-4858-90d7-520b7d240e33
> 
> Windows Media Player 10 on Windows XP SP1/SP2:
> http://www.microsoft.com/downloads/details.aspx?FamilyId=0f641
> 572-74fd-4281-953f-6f2f12e001e0
> 
> PROVIDED AND/OR DISCOVERED BY:
> Greg MacManus, iDefense Labs.
> 
> ORIGINAL ADVISORY:
> MS06-024 (KB917734):
> http://www.microsoft.com/technet/security/Bulletin/MS06-024.mspx
> 
> iDefense Labs:
> http://idefense.com/intelligence/vulnerabilities/display.php?id=406
>