Benvenuto su WolfOtakar.Com

Benvenuto su WolfOtakar.Com

Entra nella chat del nostro portale!Per chiarimenti e spiegazioni!

Windows Media Player PNG Processing Buffer Overflow  
06/14/2006

 
iDefense Lab ha scoperto una vulnerabilitÓ in Windows Media Player, la quale potrebbe essere sfruttata da un utente malevolo per compromettere il sistema di un utente.

La falla Ŕ causata da un boundary error nell'effettuare la decodifica dei chunk dei file immagine PNG (Portable Network Graphics). Inducendo l'utente a visitare un sito web malevolo (o ad aprire un file WMZ creato ad hoc), Ŕ possibile sfruttare la vulnerabilitÓ per causare uno stack overflow ed eseguire codice arbitrario.

 

Soluzione
======
Applicare le relative patch:
Windows Media Player per XP su Windows XP SP1:
http://www.microsoft.com/downloads/details.aspx?FamilyId=11372cc0-3da9-49ad-bb08-1493ce3cd0bd

Windows Media Player 9 su Windows XP SP2:
http://www.microsoft.com/downloads/details.aspx?FamilyId=c00be4c3-34ba-4858-90d7-520b7d240e33

Windows Media Player 10 su Windows XP Professional x64 Edition:
http://www.microsoft.com/downloads/details.aspx?FamilyId=f59065ec-0279-48ec-ab27-8abca715ac01

Windows Media Player 9 su Windows Server 2003:
http://www.microsoft.com/downloads/details.aspx?FamilyId=c00be4c3-34ba-4858-90d7-520b7d240e33

Windows Media Player 10 su Windows Server 2003 SP1:
http://www.microsoft.com/downloads/details.aspx?FamilyId=4f933b0c-7d2d-4049-92da-bbbe97371594

Windows Media Player 10 su Windows Server 2003 x64 Edition:
http://www.microsoft.com/downloads/details.aspx?FamilyId=facc7dfe-9b3b-48dd-a068-5bb9c6b60f87

Windows 98, Windows 98 SE, e Windows Me:
Le patch sono disponibili dal sito web Windows Update.

Windows Media Player 7.1 su Windows 2000 SP4:
http://www.microsoft.com/downloads/details.aspx?FamilyId=5abb6258-9468-4188-a178-aa46f100ab61

Windows Media Player 9 su Windows 2000 SP4 / Windows XP SP1:
http://www.microsoft.com/downloads/details.aspx?FamilyId=c00be4c3-34ba-4858-90d7-520b7d240e33

Windows Media Player 10 su Windows XP SP1/SP2:
http://www.microsoft.com/downloads/details.aspx?FamilyId=0f641572-74fd-4281-953f-6f2f12e001e0

 

 

Riferimenti
=======
MS06-024 (KB917734):
http://www.microsoft.com/technet/security/Bulletin/MS06-024.mspx

iDefense Labs:
http://idefense.com/intelligence/vulnerabilities/display.php?id=406

Secunia:
http://secunia.com/advisories/20626/

 

   

Home Page