PT-2013-4158 · Microsoft · Windows Media Player+1

Publicado 2013-07-10 · Atualizado 2018-10-12 · CVE-2013-3127

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows Media Format Runtime versions 9 and 9.5 Windows Media Format Runtime 11 Windows Media Player versions 11 and 12

Description The issue allows remote attackers to execute arbitrary code via a crafted media file. This is related to the Microsoft WMV video codec in various Windows Media Format Runtime and Windows Media Player versions.

Recommendations For Windows Media Format Runtime versions 9 and 9.5, consider disabling the use of the WMV video codec until a patch is available. For Windows Media Format Runtime 11, restrict access to media files to minimize the risk of exploitation. For Windows Media Player versions 11 and 12, avoid playing crafted media files in the affected player until the issue is resolved.

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2013-3127

ZDI-13-168

Produtos afetados

Windows Media Format Runtime

Windows Media Player

Referências · 5

• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16998 · Nota
• http://us-cert.gov/ncas/alerts/TA13-190A · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-057 · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-13-168 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2013-3127 · Nota de Segurança