PT-2002-2569 · Microsoft · Windows Media Player

Publicado 2002-12-31 · Atualizado 2021-06-15 · CVE-2002-1847

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Windows Media Player versions 6.3 through 7.1

Description A buffer overflow issue exists in the mplay32.exe component, potentially allowing remote attackers to execute arbitrary commands. This is achieved by providing a long mp3 filename as a command line argument. It's noted that the known attack vector requires command line access, which may limit the vulnerability's impact.

Recommendations For Microsoft Windows Media Player versions 6.3 through 7.1, consider restricting access to the command line argument that accepts mp3 filenames to minimize the risk of exploitation. As a temporary workaround, avoid using long mp3 filenames as command line arguments until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2002-1847

Produtos afetados

Windows Media Player

Referências · 5

• 🔥 https://exploit-db.com/exploits/21670 · Exploit
• 🔥 http://securityfocus.com/bid/5357 · Exploit
• http://iss.net/security_center/static/9727.php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-1847 · Nota de Segurança
• http://online.securityfocus.com/archive/1/285082 · Nota