PT-2006-6770 · Microsoft · Windows Media Player

Sehato · Published 2006-11-28 · Updated 2018-10-17 · CVE-2006-6134

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Windows Media Player version 10.00.00.4036

Description The issue is related to a heap-based buffer overflow in the WMCheckURLScheme function in WMVCORE.DLL, which can be exploited by remote attackers to cause a denial of service, resulting in an application crash, and potentially execute arbitrary code. This can be achieved through a long HREF attribute using an unrecognized protocol in a REF element in an ASX PlayList file.

Recommendations For Windows Media Player version 10.00.00.4036, consider disabling the WMCheckURLScheme function as a temporary workaround until a patch is available. Restrict access to ASX PlayList files to minimize the risk of exploitation. Avoid using unrecognized protocols in REF elements until the issue is resolved.

Exploit

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2006-6134

Affected Products

Windows Media Player

References · 16

• 🔥 http://securityfocus.com/bid/21247 · Exploit
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-078 · Vendor Advisory
• http://vupen.com/english/advisories/2006/4882 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-6134 · Security Note
• http://securityfocus.com/archive/1/454969/100/200/threaded · Vendor Advisory
• http://secunia.com/advisories/22971 · Vendor Advisory
• http://research.eeye.com/html/alerts/zeroday/20061122.html · Note
• http://us-cert.gov/cas/techalerts/TA06-346A.html · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A669 · Note
• http://securityfocus.com/archive/1/452352/100/0/threaded · Note
• http://support.avaya.com/elmodocs2/security/ASA-2006-274.htm · Note
• http://blogs.technet.com/msrc/archive/2006/12/07/public-proof-of-concept-code-for-asx-file-format-isssue.aspx · Note
• http://securitytracker.com/id?1017354 · Note
• http://securityfocus.com/archive/1/453579/100/0/threaded · Note
• http://securityreason.com/securityalert/1922 · Note