PT-2017-1630 · Microsoft · Windows Media Player+9

Abdulrahman Alqabandi + 1 · Published 2017-03-14 · Updated 2017-07-12 · CVE-2017-0042

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version Windows Media Player in Microsoft Windows 8.1 Windows Media Player in Microsoft Windows Server 2012 R2 Windows Media Player in Microsoft Windows RT 8.1 Windows Media Player in Microsoft Windows 7 SP1 Windows Media Player in Microsoft Windows 2008 SP2 and R2 SP1 Windows Media Player in Microsoft Windows Server 2016 Windows Media Player in Microsoft Windows Vista SP2 Windows Media Player in Microsoft Windows 10 Gold, 1511, and 1607

Description The issue allows remote attackers to obtain sensitive information via a crafted web site. This is related to the lack of protection for service data, which can be exploited by a remote attacker to gain confidential information using a specially formed website.

Recommendations For Microsoft Windows 8.1, update to a version that includes the fix for this issue. For Microsoft Windows Server 2012 R2, update to a version that includes the fix for this issue. For Microsoft Windows RT 8.1, update to a version that includes the fix for this issue. For Microsoft Windows 7 SP1, update to a version that includes the fix for this issue. For Microsoft Windows 2008 SP2 and R2 SP1, update to a version that includes the fix for this issue. For Microsoft Windows Server 2016, update to a version that includes the fix for this issue. For Microsoft Windows Vista SP2, update to a version that includes the fix for this issue. For Microsoft Windows 10 Gold, 1511, and 1607, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to Windows Media Player until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2017-00783

CVE-2017-0042

Affected Products

Windows

Windows 10

Windows 2008

Windows 7

Windows 8.1

Windows Media Player

Windows Rt 8.1

Windows Server 2012 R2

Windows Server 2016

Windows Vista

References · 10

• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2017-0042 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-0042 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0042 · Security Note
• https://osv.dev/vulnerability/CVE-2017-0042 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0042 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-00783 · Security Note
• http://pastebin.com/raw/Eztknq4s · Note
• http://securitytracker.com/id/1038016 · Note
• http://securityfocus.com/bid/96098 · Note
• https://twitter.com/Qab/status/842506404950917120 · Note