Microsoft Security Bulletin MS03-021: Flaw In Windows Media Player May Allow Media Library Access(Q819639)

["Microsoft" <0_49448_04BF067D-4CF8-4245-B5C1-58573E5746A8_US () Newsletters Microsoft com>]

-----BEGIN PGP SIGNED MESSAGE-----

- - ------------------------------------------------------------------
Title:      Flaw In Windows Media Player May Allow Media Library 
            Access (819639)
Date:       25 June 2003
Software:   Microsoft(r) Windows(r) Media Player 9 Series
Impact:     Information disclosure
Max Risk:   Moderate
Bulletin:   MS03-021

Microsoft encourages customers to review the Security Bulletins at: 
http://www.microsoft.com/technet/security/bulletin/MS03-021.asp
http://www.microsoft.com/security/security_bulletins/ms03-021.asp
- - ------------------------------------------------------------------

Issue:
======
An ActiveX control included with Windows Media Player 9 Series 
allows Web page authors to create Web pages that can play media and 
provide a user interface by which the user can control playback. 
When a user visits a Web page with embedded media, the ActiveX 
control provides a user interface that allows the user to take such 
actions as pausing or rewinding the media.

A flaw exists in the way in which the ActiveX control provides 
access to information on the user's computer. A vulnerability exists 
because an attacker could invoke the ActiveX control from script 
code, which would allow the attacker to view and manipulate metadata 
contained in the media library on the user's computer.

To exploit this flaw, an attacker would have to host a malicious Web 
site that contained a Web page designed to exploit this 
vulnerability, and then persuade a user to visit that site-an 
attacker would have no way to force a user to the site. An attacker 
could also embed a link to the malicious site in an HTML e-mail and 
send it to the user.  After the user previewed or opened the e-mail, 
the malicious site could be visited automatically without further 
user interaction.

The attacker would only have access to manipulate the media library 
on the user's computer. The attacker would not be able to browse the 
user's hard disk and would not have access to passwords or encrypted 
data. The attacker would not be able to modify files on the user's 
hard disk, but could modify the contents of any Media Library 
entries associated with those files. The attacker might also be able 
to determine the user name of the logged-on user by examining the 
directory paths to media files.

Mitigating Factors:
====================
 - By default, Internet Explorer on Windows Server 2003 runs in 
Enhanced Security Configuration. This default configuration of 
Internet Explorer blocks this attack.
 - The attacker could only gain access to information contained in 
the Windows Media Library
 - The attacker would not be able to execute code on the system or 
delete files on the user's hard disk.

Risk Rating:
============
Moderate

Patch Availability:
===================
 - A patch is available to fix this vulnerability. Please read the 
   Security Bulletins at
   
http://www.microsoft.com/technet/security/bulletin/ms03-021.asp
http://www.microsoft.com/security/security_bulletins/ms03-021.asp
   
   for information on obtaining this patch.

Acknowledgment:
===============
 - Jelmer (jelmer () kuperus xs4all nl)

- - ------------------------------------------------------------------

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS 
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS 
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE 
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 
IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE 
FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, 
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF 
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE 
POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION 
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES 
SO THE FOREGOING LIMITATION MAY NOT APPLY.

-----BEGIN PGP SIGNATURE-----
Version: PGP 7.1

iQEVAwUBPvnLro0ZSRQxA/UrAQE09Qf/RXUba6uNDhjRj+Q9C/3F4j04Wjf9g40r
6sKoFxzIF7lAdXQpY1b4efGidjasg1/LGIU33vxBNG73U60tUO1h0J8ryBE4KAO9
+6DWgB3c3KHj43BjsFF6IZu8sjY5xOWQPB8B2kPT1i7vfvCUaZYb7gOPO7hbUxSq
etS99k86/CKSPan/14slamc3n6QPuRRs4FR9hAbn54rflICJ/WbxV1dK+YxtRCVS
fCmlqN0wOgjp+2wP41GlfXJz9ar9+M6Obs6na2/BGgADXpGRqm0ofqYy2btj2Fg9
DMQeWFFLQiIjLjX4OcpGWJu3I24V0XsXTsVm7LTvefcvHNeA7ZoBXA==
=JVIB
-----END PGP SIGNATURE-----


*******************************************************************

You have received this e-mail bulletin because of your subscription to the Microsoft Product Security Notification 
Service.  For more information on this service, please visit http://www.microsoft.com/technet/security/notify.asp.
 
To verify the digital signature on this bulletin, please download our PGP key at 
http://www.microsoft.com/technet/security/notify.asp.
 
To unsubscribe from the Microsoft Security Notification Service, please visit the Microsoft Profile Center at 
http://register.microsoft.com/regsys/pic.asp 
 
If you do not wish to use Microsoft Passport, you can unsubscribe from the Microsoft Security Notification Service via 
email as described below:
Reply to this message with the word UNSUBSCRIBE in the Subject line.
 
For security-related information about Microsoft products, please visit the Microsoft Security Advisor web site at 
http://www.microsoft.com/security.