PT-2001-1472 · Microsoft · Windows Media Player

Published 2001-06-27 · Updated 2018-10-12 · CVE-2001-0243

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Windows Media Player versions 7 and earlier

Description The issue allows remote attackers to read certain files due to the way Windows Media Player stores Internet shortcuts. Specifically, it stores them in a user's Temporary Files folder with a fixed filename, instead of in the Internet Explorer cache. This causes the HTML in those shortcuts to run in the Local Computer Zone instead of the Internet Zone.

Recommendations For Windows Media Player versions 7 and earlier, consider restricting access to sensitive files as a temporary workaround until a patch is available. Avoid using Windows Media Player to open Internet shortcuts from untrusted sources.

Fix

Related Identifiers

CVE-2001-0243

Affected Products

Windows Media Player

References · 4

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-029 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-0243 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6584 · Note
• http://securityfocus.com/bid/2765 · Note