Security researcher finds flaw in Windows Media Player
Petko Petkov outlines Windows hack using malicious media files
Computerworld - Hackers can wield malicious Windows Media Player files to exploit any unpatched Internet Explorer (IE) vulnerability on a PC -- even if the user relies on Firefox, Opera or some other Web browser, a U.K. security researcher said yesterday.
Microsoft Corp. is investigating, a spokesman said today.
Petko Petkov, a penetration tester who released proof-of-concept code last week for a flaw in Apple Inc.'s QuickTime, said Tuesday that Microsoft's media software also harbors critical bugs that could be used to hijack PCs. On his blog, Petkov posted several exploits targeting a vulnerability in the "HTMLView value" XML tag that's used in several support Windows Media Player file formats, including .asx.
"HTMLView will display a page of our choice within the stand-alone Windows Media Player," Petkov said. "I repeat, the page will be opened within the Media Player surroundings, not a stand-alone browser. This is very interesting behavior."
On a fully-patched PC running Windows XP SP2 with either IE6 or IE7, Petkov was able to force Media Player to open a malicious URL. "Let me translate this for you," he said. "It means that even if you are running Firefox and you think that you are secure, by simply opening a media file, you expose yourself to all IE vulnerabilities."
Petkov embedded malicious script code into the pages he created, then injected into Media Player in the multiple exploit samples he posted on his blog yesterday. In his proofs of concept, the script simply launches a pop-up window that tells the user his machine has been compromised.
Version 11 of Media Player throws up a confirmation dialog box that may make some users think twice about allowing a malicious file to access the program, as does Media Player 10. Earlier editions, however, including Version 9, blithely allow the exploit without warning the user.
"Attackers are in [a] very good position to abuse the technology," said Petkov.
Late last night, Symantec Corp. warned customers of its DeepSight threat network about Petkov's findings, including the Windows Media Player problem. "[These] provide an indirect vector to execute malicious script code, which in some cases may be more difficult to filter," Symantec said in a security bulletin.
Petkov's domain, including his blog and the posted exploits, was offline Wednesday morning, but a cached version of the entry's text was available from Google.
Microsoft is looking into Petkov's claims, but a spokesman downplayed the threat. "We're currently unaware of any attacks trying to use the claimed vulnerability, or of customer impact," he said today via e-mail. "We will take steps to determine how customers can protect themselves should we confirm the vulnerability."
The next scheduled security update from Microsoft is slated for Oct. 9.
Windows Media Player has been pinned with one other critical vulnerability so far this year (Microsoft patched it in August) and three during 2006. The new Media Player 11, which is bundled with Windows Vista, debuted October 2006 and has been patched only once.
Read more about Security in Computerworld's Security Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts