http://www.microsoft.com/technet/security/bulletin/ms07-047.mspx

Microsoft Security Bulletin MS07-047 - Important
Vulnerabilities in Windows Media Player Could Allow Remote Code Execution (936782)
Published: August 14, 2007

Version: 1.0
General Information
Executive Summary

This important security update resolves two privately reported vulnerabilities. These vulnerabilities could allow code execution if a user viewed a specially crafted file in Windows Media Player. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

This is an important security update for supported versions of Windows Media Player 7.1, 9, 10, and 11. For more information, see the subsection, Affected and Non-Affected Software, in this section.

For more information about the vulnerabilities, see the Frequently Asked Questions (FAQ) subsection for the specific vulnerability entry under the next section, Vulnerability Information.

Recommendation. Microsoft recommends that customers apply the update.

Known Issues. Microsoft Knowledge Base Article 936782 documents the currently known issues that customers may experience when they install this security update. The article also documents recommended solutions for these issues.
Top of sectionTop of section
Affected and Non-Affected Software

The software listed here has been tested to determine which versions or editions are affected. Other versions or editions are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, visit Microsoft Support Lifecycle.

Affected Software
Operating System Component Maximum Security Impact Aggregate Severity Rating Bulletins Replaced by This Update

Windows 2000 Service Pack 4

Windows Media Player 7.1

Remote Code Execution

Important

MS06-024

Windows 2000 Service Pack 4

Windows Media Player 9

Remote Code Execution

Important

MS06-024

Windows XP Service Pack 2

Windows Media Player 9

Remote Code Execution

Important

MS06-024

Windows XP Service Pack 2

Windows Media Player 10

Remote Code Execution

Important

MS06-024

Windows XP Professional X64 Edition

Windows Media Player 10

Remote Code Execution

Important

MS06-024

Windows XP Professional X64 Edition Service Pack 2

Windows Media Player 10

Remote Code Execution

Important

None

Windows Server 2003 Service Pack 1

Windows Media Player 10

Remote Code Execution

Important

MS06-024

Windows Server 2003 Service Pack 2

Windows Media Player 10

Remote Code Execution

Important

None

Windows Server 2003 x64 Edition

Windows Media Player 10

Remote Code Execution

Important

MS06-024

Windows Server 2003 x64 Edition Service Pack 2

Windows Media Player 10

Remote Code Execution

Important

None

Windows XP Service Pack 2

Windows Media Player 11

Remote Code Execution

Important

MS06-024

Windows XP Professional X64 Edition

Windows Media Player 11

Remote Code Execution

Important

MS06-024

Windows XP Professional X64 Edition Service Pack 2

Windows Media Player 11

Remote Code Execution

Important

None

Windows Vista

Windows Media Player 11

Remote Code Execution

Important

None

Windows Vista x64 Edition

Windows Media Player 11

Remote Code Execution

Important

None
Top of sectionTop of section

Frequently Asked Questions (FAQ) Related to This Security Update

What are the known issues that customers may experience when they install this security update?
Microsoft Knowledge Base Article 936782 documents the currently known issues that customers may experience when they install this security update. The article also documents recommended solutions for these issues.

I am using an older release of the software discussed in this security bulletin. What should I do?
The affected software listed in this bulletin has been tested to determine which releases are affected. Other releases are past their support life cycle. To determine the support life cycle for your software release, visit Microsoft Support Lifecycle.

It should be a priority for customers who have older releases of the software to migrate to supported releases to prevent potential exposure to vulnerabilities. For more information about the Windows Product Lifecycle, visit the following Microsoft Support Lifecycle. For more information about the extended security update support period for these software releases, visit the Microsoft Product Support Services Web site.

Customers who require custom support for older software must contact their Microsoft account team representative, their Technical Account Manager, or the appropriate Microsoft partner representative for custom support options. Customers without an Alliance, Premier, or Authorized Contract can contact their local Microsoft sales office. For contact information, visit the Microsoft Worldwide Information Web site, select the country, and then click Go to see a list of telephone numbers. When you call, ask to speak with the local Premier Support sales manager. For more information, see the Windows Operating System Product Support Lifecycle FAQ.

Does this update contain any security-related changes to functionality?
Yes. Besides the changes that are listed in the Frequently Asked Questions (FAQ) subsection for the specific vulnerability entry under the bulletin section, Vulnerability Information, this update includes defense-in-depth changes to Windows Media Player. For more information about the defense-in-depth, see Microsoft Knowledge Base Article 940893.
Top of sectionTop of section
Vulnerability Information

Severity Ratings and Vulnerability Identifiers
Affected Software Windows Media Player Code Execution Vulnerability Parsing Skins – CVE-2007-3037 Windows Media Player Code Execution Vulnerability Decompressing Skins - CVE-2007-3035 Aggregate Severity Rating

Windows Media Player 7.1

Important
Remote Code Execution

Important
Remote Code Execution

Important

Windows Media Player 9

Important
Remote Code Execution

Important
Remote Code Execution

Important

Windows Media Player 10

Important
Remote Code Execution

Important
Remote Code Execution

Important

Windows Media Player 11

Important
Remote Code Execution

Important
Remote Code Execution

Important
Top of sectionTop of section

Windows Media Player Code Execution Vulnerability Parsing Skins – CVE-2007-3037

A code execution vulnerability exists in Windows Media Player skin parsing. An attacker who successfully exploited this vulnerability could take complete control of an affected system.

To view this vulnerability as a standard entry in the Common Vulnerabilities and Exposures list, see CVE-2007-3037.

Mitigating Factors for Windows Media Player Code Execution Vulnerability Parsing Skins – CVE-2007-3037

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, which could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in your situation:
•

When a user attempts to install a Windows Media Player skin file, the user is prompted with a "Windows Media Download" dialog box prior to the skin being applied.
•

Attempts to exploit the vulnerability using WMZ and WMD files require the user to view or apply the skin after it is downloaded to be vulnerable.
Top of sectionTop of section

Workarounds for Windows Media Player Code Execution Vulnerability Parsing Skins – CVE-2007-3037

Disassociate the WMZ and WMD file extensions

Disassociation of WMZ and WMD in Windows prevents previewing or opening WMZ and WMD files in Windows Media Player.

Click Start, click Run, type "regedit” (without the quotation marks), and then click OK.

Expand HKEY_CLASSES_ROOT, and click .WMZ, and then right click and select Export. Note: This will create a backup of this registry key in the ‘My Documents’ folder by default.

In the Export Registry File window, type “WMZ file association registry backup.reg” and press Save.

This will create a backup of this registry key in the “My Documents” folder by default.

Press the Delete key on the keyboard to delete the registry key. Select Yes to confirm the registry key deletion.

Repeat steps 2-5 for the WMDkey.

Impact of Workaround: This workaround prevents users from applying skin files to Windows Media Player by double clicking on them. Users can still apply skin files that are in their default ‘skins’ directory.

Un-register Wmp.dll

Un-registering the Wmp.dll registry key helps protect the affected system from attempts to exploit this vulnerability. To modify the Wmp.dll registry key, follow these steps.

Click Start, click Run, type "regsvr32 -u %windir%\system32\wmp.dll" (without the quotation marks), and then click OK.

When a dialog box appears that confirms that the process has been successful, click OK.

Select the File Types tab.

Impact of Workaround: This workaround disables the Windows Media Player and applications that use the embedded Windows Media ActiveX Control.
Top of sectionTop of section

FAQ for Windows Media Player Code Execution Vulnerability Parsing Skins – CVE-2007-3037

What is the scope of the vulnerability?
A code execution vulnerability exists in Windows Media Player parsing skins. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs or view, change, or delete data.

What causes the vulnerability?
Windows Media Player incorrectly handles header information contained in skin files.

What is a skin file?
Skins are sets of scripts, art, media, and text files that can be combined to create a new appearance for Windows Media Player. Using skins, you can change not only the way Windows Media Player looks, but how it functions. Windows Media Player skin files are distributed in WMZ and WMD files.

What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could take complete control of an affected system. Users whose accounts are configured to have fewer user rights on the guest operating system are less impacted than users who operate with administrative user rights on the guest operating system.

How could an attacker exploit the vulnerability?
In a Web-based attack scenario, an attacker could host a specially-crafted skin file designed to exploit this vulnerability through Windows Media Player and then convince a user to view the skins file. In no case, however, would an attacker have a way to force users to visit these Web sites. Instead, an attacker would have to convince users to visit the Web site, typically by getting them to click a link in an e-mail message or in an Instant Messenger request that takes users to the attacker's Web site.

In an e-mail attack scenario, an attacker could exploit the vulnerability by sending a specially-crafted skin file to the user and by persuading the user to open the file.

What systems are primarily at risk from the vulnerability?
This vulnerability requires that a user is logged on and opens the malicious skin file in Windows Media Player for any malicious action to occur. Therefore, any systems where Windows Media Player is used frequently, such as workstations or terminal servers, are at the most risk from this vulnerability.

What does the update do?
The update removes the vulnerability by changing Windows Media Player to correctly handle header information contained in skin files.

When this security bulletin was issued, had this vulnerability been publicly disclosed?
No. Microsoft received information about this vulnerability through responsible disclosure. Microsoft had not received any information to indicate that this vulnerability had been publicly disclosed when this security bulletin was originally issued.
Top of sectionTop of section
Top of sectionTop of section

Windows Media Player Code Execution Vulnerability Decompressing Skins - CVE-2007-3035

A remote code execution vulnerability exists in Windows Media Player an attacker who successfully exploited this vulnerability could take complete control of an affected system.

To view this vulnerability as a standard entry in the Common Vulnerabilities and Exposures list, see CVE-2007-3035.

Mitigating Factors for Windows Media Player Code Execution Vulnerability Decompressing Skins - CVE-2007-3035

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, which could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in your situation:
•

When a user attempts to install a Windows Media Player skin file, the user is prompted with a "Windows Media Download" dialog box prior to the skin being applied.
•

Attempts to exploit the vulnerability using WMZ and WMD files require the user to view or apply the skin after it is downloaded to be vulnerable.
Top of sectionTop of section

Workarounds for Windows Media Player Code Execution Vulnerability Decompressing Skins - CVE-2007-3035

Disassociate the WMZ and WMD file extensions

Disassociation of WMZ and WMD in Windows prevents previewing or opening WMZ and WMD files in Windows Media Player.

Click Start, click Run, type "regedit” (without the quotation marks), and then click OK.

Expand HKEY_CLASSES_ROOT, and click .WMZ, and then right click and select Export. Note: This will create a backup of this registry key in the ‘My Documents’ folder by default.

In the Export Registry File window, type “WMZ file association registry backup.reg” and press Save.

This will create a backup of this registry key in the “My Documents” folder by default.

Press the Delete key on the keyboard to delete the registry key. Select Yes to confirm the registry key deletion.

Repeat steps 2-5 for the WMD key.

Impact of Workaround: This workaround prevents users from applying skin files to Windows Media Player by double clicking on them. Users can still apply skin files that are in their default ‘skins’ directory.

Un-register Wmp.dll

Un-registering the Wmp.dll registry key helps protect the affected system from attempts to exploit this vulnerability. To modify the Wmp.dll registry key, follow these steps.

Click Start, click Run, type "regsvr32 -u %windir%\system32\wmp.dll" (without the quotation marks), and then click OK.

When a dialog box appears that confirms that the process has been successful, click OK.

Select the File Types tab.

Impact of Workaround: This workaround disables the Windows Media Player and applications that use the embedded Windows Media ActiveX Control.
Top of sectionTop of section

FAQ for Windows Media Player Code Execution Vulnerability Decompressing Skins - CVE-2007-3035

What is the scope of the vulnerability?
A code execution vulnerability exists in Windows Media Player skin parsing. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs or view, change, or delete data.

What causes the vulnerability?
Windows Media Player incorrectly handles header information contained in skin files.

What is a skin file?
Skins are sets of scripts, art, media, and text files that can be combined to create a new appearance for Windows Media Player. Using skins, you can change not only the way Windows Media Player looks, but how it functions. Windows Media Player skin files are distributed in WMZ and WMD files.

What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could take complete control of an affected system. Users whose accounts are configured to have fewer user rights on the guest operating system are less impacted than users who operate with administrative user rights on the guest operating system.

How could an attacker exploit the vulnerability?
In a Web-based attack scenario, an attacker could host a specially-crafted skin file designed to exploit this vulnerability through Windows Media Player and then convince a user to view the skins file. In no case, however, would an attacker have a way to force users to visit these Web sites. Instead, an attacker would have to convince users to visit the Web site, typically by getting them to click a link in an e-mail message or in an Instant Messenger request that takes users to the attacker's Web site.

In an e-mail attack scenario, an attacker could exploit the vulnerability by sending a specially-crafted skin file to the user and by persuading the user to open the file.

What systems are primarily at risk from the vulnerability?
This vulnerability requires that a user is logged on and opens the malicious skin file in Windows Media Player for any malicious action to occur. Therefore, any systems where Windows Media Player is used frequently, such as workstations or terminal servers, are at the most risk from this vulnerability.

What does the update do?
The update removes the vulnerability by changing Windows Media Player to correctly handle header information contained in skin files.

When this security bulletin was issued, had this vulnerability been publicly disclosed?
No. Microsoft received information about this vulnerability through responsible disclosure. Microsoft had not received any information to indicate that this vulnerability had been publicly disclosed when this security bulletin was originally issued.
Other Information
Acknowledgments

Microsoft thanks the following for working with us to help protect customers:
•

Piotr Bania, working with TippingPoint and the Zero Day Initiative, for reporting the Windows Media Player Code Execution Vulnerability Decompressing Skins - CVE-2007-3035.
•

Piotr Bania, working with TippingPoint and the Zero Day Initiative, for reporting the Windows Media Player Code Execution Vulnerability Parsing Skins – CVE-2007-3037.
•

Dan Kaminsky, of IOActive, for reporting the defense-in-depth changes to the Windows Media Player described in Microsoft Knowledge Base Article 940893

Support
•

Customers in the U.S. and Canada can receive technical support from Microsoft Product Support Services at 1-866-PCSAFETY. There is no charge for support calls that are associated with security updates.
•

International customers can receive support from their local Microsoft subsidiaries. There is no charge for support that is associated with security updates. For more information about how to contact Microsoft for support issues, visit the International Support Web site.

Disclaimer

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions
•

V1.0 (August 14, 2007): Bulletin published.