PT-2006-1101 · Microsoft · Windows Media Player+1

John Cobb · Publicado 2006-02-14 · Atualizado 2019-04-30 · CVE-2006-0005

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Microsoft Windows Media Player versions 9 through 10

Description: A buffer overflow issue exists in the plug-in for Microsoft Windows Media Player, specifically when used in browsers other than Internet Explorer and set as the default application to handle media files. This allows remote attackers to execute arbitrary code via HTML with an EMBED element containing a long src attribute.

Recommendations: For Microsoft Windows Media Player versions 9 through 10, consider disabling the plug-in for non-Internet Explorer browsers as a temporary workaround until a patch is available. Restrict access to handling media files to minimize the risk of exploitation. Avoid using the EMBED element with long src attributes in HTML until the issue is resolved.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2006-0005

Produtos afetados

Internet Explorer

Windows Media Player

Referências · 14

• 🔥 https://exploit-db.com/exploits/1504 · Exploit
• 🔥 https://exploit-db.com/exploits/1520 · Exploit
• 🔥 https://exploit-db.com/exploits/1505 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24493 · Nota
• http://kb.cert.org/vuls/id/692060 · Nota
• http://securityfocus.com/bid/16644 · Nota
• http://us-cert.gov/cas/techalerts/TA06-045A.html · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1559 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-006 · Aviso do Fabricante
• http://secunia.com/advisories/18852 · Aviso do Fabricante
• http://vupen.com/english/advisories/2006/0575 · Nota
• http://idefense.com/intelligence/vulnerabilities/display.php?id=393 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-0005 · Nota de Segurança
• http://securitytracker.com/id?1015628 · Nota