Microsoft investigating Windows Media Player flaws

Share this article:

Microsoft this week warned Windows Media Player users that a flaw in the program is susceptible to proof-of-concept malicious code.

Redmond is investigating reports of PoC code using Windows Media ASX files, although the company is not aware of any attacks.

A malicious user could employ a corrupted file to cause Media Player to overrun a heap-allocated bugger, potentially leading to remote code execution, according to a post on the Microsoft Security Response Center blog by researcher Alexandra Huft.

An attacker could use the flaw to cause a DoS attack or compromise a user's system, according to a Secunia report.

The flaw is caused by a boundary error when handling "REF HREF" tags in ASX playlists. It has been reported in version 10.00.00.4036.

Earlier this week, Microsoft revealed that it will release six security fixes on Tuesday as part of its monthly patch distribution.

The software giant did not say it would release a Patch Tuesday fix for a recently discovered flaw in Microsoft Word, despite active attacks against the vulnerability in the wild.

Click here to email Frank Washkuch Jr.
Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

More in News

Reported breaches involving zero-day bug at JPMorgan Chase, other banks

Reported breaches involving zero-day bug at JPMorgan Chase, ...

Hackers exploited a zero-day vulnerability and gained access to sensitive information from JPMorgan Chase and at least four other financial institutions, reports indicate.

Data on 97K Bugzilla users posted online for about three months

During a migration of the testing server for test builds of Bugzilla software, data on about 97,000 Bugzilla users was inadvertently posted publicly online.

Chinese national had access to data on 5M Arizona drivers, possible breach ...

Although Lizhong Fan left the U.S. in 2007, the agencies responsible for giving him access to Americans' personal information have yet to disclose the details of the case to the public.