PT-2011-2039 · Microsoft · Windows Media Center+2

Published 2011-03-09 · Updated 2025-01-21 · CVE-2011-0042

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows Media Player and Windows Media Center versions prior to the fixed version

Description A remote code execution issue exists in the way Windows Media Player and Windows Media Center handle Digital Video Recording (.dvr-ms) files. This allows remote attackers to execute arbitrary code via a crafted file. An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Windows Media Player and Windows Media Center, update to a version that properly parses .dvr-ms files to prevent remote code execution. As a temporary workaround, consider avoiding the use of .dvr-ms files in Windows Media Player and Windows Media Center until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-0042

Affected Products

Windows

Windows Media Center

Windows Media Player

References · 12

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-015 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0042 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0042 · Security Note
• http://osvdb.org/71016 · Note
• http://us-cert.gov/cas/techalerts/TA11-067A.html · Note
• http://securityfocus.com/bid/46680 · Note
• http://securitytracker.com/id?1025169 · Note
• http://vupen.com/english/advisories/2011/0615 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12281 · Note
• http://secunia.com/advisories/43626 · Note
• https://t.me/cvenotify/108083 · Telegram Post
• https://docs.microsoft.com/security-updates/securitybulletins/2011/MS11-015 · Note