[SECURITY-L] CAIS-Alerta: Vulnerabilidade no Windows Media Player 9 (819639)

Qui Jun 26 16:46:54 -03 2003

----- Forwarded message from Centro de Atendimento a Incidentes de Seguranca <cais em cais.rnp.br> -----

From: Centro de Atendimento a Incidentes de Seguranca <cais em cais.rnp.br>
Subject: CAIS-Alerta: Vulnerabilidade no Windows Media Player 9 (819639)
To: rnp-alerta em cais.rnp.br, rnp-seg em cais.rnp.br
Date: Thu, 26 Jun 2003 13:34:36 -0300 (BRT)

-----BEGIN PGP SIGNED MESSAGE-----

O CAIS está repassando o alerta divulgado pela Microsoft, Microsoft
Security Bulletin MS03-021: Flaw In Windows Media Player May Allow Media
Library Access (819639), que trata de uma vulnerabilidade identificada no
Windows Media Player 9, capaz de permitir o acesso a informacoes da
maquina atacada pelo atacante.

Sistemas Afetados:

        . Microsoft Windows Media Player 9 Series

Correções disponíveis:

A correção consiste na aplicação dos patches recomendados pela Microsoft e
disponíveis em:

	Windows Media Player 9 Series
	http://microsoft.com/downloads/details.aspx?FamilyId=36814221-8194-4492-BB29-94DB3D4CB682&displaylang=en

	Windows Media Player 9 Series on Windows Server 2003
	http://microsoft.com/downloads/details.aspx?FamilyId=82CD6192-15D8-4E28-9B14-F9B78FF01D8A&displaylang=en

Maiores informações:

	http://www.microsoft.com/technet/security/bulletin/ms03-021.asp

Identificador do CVE: CAN-2003-0348 (http://cve.mitre.org)

O CAIS recomenda aos administradores de plataformas Microsoft que
mantenham seus sistemas e aplicativos sempre atualizados.

Atenciosamente,

################################################################
#   CENTRO DE ATENDIMENTO A INCIDENTES DE SEGURANCA / RNP      #
#                                                              #
# cais em cais.rnp.br     http://www.cais.rnp.br                  #
# Tel. 019-37873300    Fax. 019-37873301                       #
# Chave PGP disponivel em: http://www.cais.rnp.br/cais-pgp.key #
################################################################

- - ------------------------------------------------------------------
Title:      Flaw In Windows Media Player May Allow Media Library
            Access (819639)
Date:       25 June 2003
Software:   Microsoft(r) Windows(r) Media Player 9 Series
Impact:     Information disclosure
Max Risk:   Moderate
Bulletin:   MS03-021

Microsoft encourages customers to review the Security Bulletins at:
http://www.microsoft.com/technet/security/bulletin/MS03-021.asp
http://www.microsoft.com/security/security_bulletins/ms03-021.asp
- - ------------------------------------------------------------------

Issue:
======
An ActiveX control included with Windows Media Player 9 Series
allows Web page authors to create Web pages that can play media and
provide a user interface by which the user can control playback.
When a user visits a Web page with embedded media, the ActiveX
control provides a user interface that allows the user to take such
actions as pausing or rewinding the media.

A flaw exists in the way in which the ActiveX control provides
access to information on the user's computer. A vulnerability exists
because an attacker could invoke the ActiveX control from script
code, which would allow the attacker to view and manipulate metadata
contained in the media library on the user's computer.

To exploit this flaw, an attacker would have to host a malicious Web
site that contained a Web page designed to exploit this
vulnerability, and then persuade a user to visit that site-an
attacker would have no way to force a user to the site. An attacker
could also embed a link to the malicious site in an HTML e-mail and
send it to the user.  After the user previewed or opened the e-mail,
the malicious site could be visited automatically without further
user interaction.

The attacker would only have access to manipulate the media library
on the user's computer. The attacker would not be able to browse the
user's hard disk and would not have access to passwords or encrypted
data. The attacker would not be able to modify files on the user's
hard disk, but could modify the contents of any Media Library
entries associated with those files. The attacker might also be able
to determine the user name of the logged-on user by examining the
directory paths to media files.

Mitigating Factors:
====================
 - By default, Internet Explorer on Windows Server 2003 runs in
Enhanced Security Configuration. This default configuration of
Internet Explorer blocks this attack.
 - The attacker could only gain access to information contained in
the Windows Media Library
 - The attacker would not be able to execute code on the system or
delete files on the user's hard disk.

Risk Rating:
============
Moderate

Patch Availability:
===================
 - A patch is available to fix this vulnerability. Please read the
   Security Bulletins at

http://www.microsoft.com/technet/security/bulletin/ms03-021.asp
http://www.microsoft.com/security/security_bulletins/ms03-021.asp

   for information on obtaining this patch.

Acknowledgment:
===============
 - Jelmer (jelmer em kuperus.xs4all.nl)

- - ------------------------------------------------------------------

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE
FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.

*******************************************************************

You have received this e-mail bulletin because of your subscription to the
Microsoft Product Security Notification Service.  For more information on
this service, please visit
http://www.microsoft.com/technet/security/notify.asp.

To verify the digital signature on this bulletin, please download our PGP
key at http://www.microsoft.com/technet/security/notify.asp.

To unsubscribe from the Microsoft Security Notification Service, please
visit the Microsoft Profile Center at
http://register.microsoft.com/regsys/pic.asp

If you do not wish to use Microsoft Passport, you can unsubscribe from the
Microsoft Security Notification Service via email as described below:
Reply to this message with the word UNSUBSCRIBE in the Subject line.

For security-related information about Microsoft products, please visit
the Microsoft Security Advisor web site at
http://www.microsoft.com/security.