PT-2011-4432 · Microsoft · Windows Vista+5

Published 2011-12-13 · Updated 2023-12-07 · CVE-2011-3401

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows Media Player versions in Microsoft Windows XP SP2 and SP3, Windows Vista SP2, and Windows 7 Gold and SP1

Description A remote code execution issue exists in the way Windows Media Player and Windows Media Center handle .dvr-ms files. This could allow an attacker to execute arbitrary code if a user is convinced to open a specially crafted .dvr-ms file. An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Windows Media Player in Microsoft Windows XP SP2 and SP3, Windows Vista SP2, and Windows 7 Gold and SP1, consider avoiding the use of .dvr-ms files until a patch is available. As a temporary workaround, restrict access to Windows Media Player and Windows Media Center to minimize the risk of exploitation.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2011-3401

Affected Products

Windows

Windows 7

Windows Media Center

Windows Media Player

Windows Vista

Windows Xp

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2011-3401 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-092 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3401 · Security Note
• http://us-cert.gov/cas/techalerts/TA11-347A.html · Note
• http://technet.microsoft.com/en-us/security/bulletin/MS11-092 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14281 · Note