Microsoft Security Bulletin MS01-010

[Microsoft Product Security <secnotif () MICROSOFT COM>]

The following is a Security  Bulletin from the Microsoft Product Security
Notification Service.

Please do not  reply to this message,  as it was sent  from an unattended
mailbox.
                    ********************************

-----BEGIN PGP SIGNED MESSAGE-----

- ----------------------------------------------------------------------
Title:      Patch Available for
            "Windows Media Player Skins File Download" Vulnerability
Date:       February 14, 2001
Software:   Windows Media Player 7
Impact:     Run arbitrary code
Bulletin:   MS01-010

Microsoft encourages customers to review the Security Bulletin at:
http://www.microsoft.com/technet/security/bulletin/MS01-010.asp.
- ----------------------------------------------------------------------

Issue:
======
Windows Media Player 7 introduced a feature called "skins", that
allows customization of the look and feel of Windows Media Player. If
a Windows Media Player skin (.WMZ) file were downloaded from a
malicious web site it could potentially be used to run Java code to
read and browse files on a local machine. The vulnerability stems
from the fact that "skins" are downloaded to a known location on a
victim's computer and are stored in a .zip package. If the .zip
package contained a Java class (.class) file, any Java code in this
class could be executed under the local computer security zone.

If a Windows Media Player skin (.WMZ) file were downloaded from a
malicious web site, it could potentially cause the deployment of
zipped Java code to a known location on the visiting user's machine.
Since the Java code would reside in a known location on the machine,
script hosted on a hostile web site or embedded in a hostile HTML
mail message could potentially invoke the script in the local
computer security zone to take arbitrary action on the user's
machine.

Mitigating Factors:
====================
 - Disable the running of unsigned Java content
 - Be wary of visiting malicious web sites or opening e-mail from
   unknown sources

Patch Availability:
===================
 - A patch is available to fix this vulnerability. Please read the
   Security Bulletin
   http://www.microsoft.com/technet/security/bulletin/ms01-010.asp
   for information on obtaining this patch.

- ---------------------------------------------------------------------

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED
"AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL
WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT
SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY
DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO
THE FOREGOING LIMITATION MAY NOT APPLY.

-----BEGIN PGP SIGNATURE-----
Version: PGP Personal Privacy 6.5.3

iQEVAwUBOorNCo0ZSRQxA/UrAQGW2gf/WO7Jp9PXvCspTxQ+ZKgJtWALi1mnDz/z
IfyrxZ6vIGdkgdRKCVPPHx+w27hzPvIU1B9Pm+UkcjQlj3QOWGTQjJhL3ANW1oFU
3pwGcJbv1LoibFB7Z99E+JRPWXi1JGupE2/06jCLBF/2KC9+kmu762tCfmuurlrk
44QUdnUyWxC3iIl8qEHvNZYK8qKLcKvyrn9bz5KFMcp4u9dX2SsneuSzi8FZbzxG
H2CUYOF95ETKd0zdc6qr0ZIUuPMyDeF4Yjnwlx6xz0DAeFJwwhoIM4I9kV7CYZxi
ODGRZFYc0QJlLtlPOsBAyngCSWseHQ7mJSTyKYEcmRev0IeMfGqOvw==
=eeF9
-----END PGP SIGNATURE-----

   *******************************************************************
You have received  this e-mail bulletin as a result  of your registration
to  the   Microsoft  Product  Security  Notification   Service.  You  may
unsubscribe from this e-mail notification  service at any time by sending
an  e-mail  to  MICROSOFT_SECURITY-SIGNOFF-REQUEST () ANNOUNCE MICROSOFT COM
The subject line and message body are not used in processing the request,
and can be anything you like.

To verify the digital signature on this bulletin, please download our PGP
key at http://www.microsoft.com/technet/security/notify.asp.

For  more  information on  the  Microsoft  Security Notification  Service
please  visit  http://www.microsoft.com/technet/security/notify.asp.  For
security-related information  about Microsoft products, please  visit the
Microsoft Security Advisor web site at http://www.microsoft.com/security.