Vulnerabilities > CVE-2006-6134 - Buffer Errors vulnerability in Microsoft Windows Media Player 10.00.00.4036

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
microsoft
CWE-119
nessus
NVD
Published: 2006-11-28
Updated: 2018-10-17

Summary

Heap-based buffer overflow in the WMCheckURLScheme function in WMVCORE.DLL in Microsoft Windows Media Player (WMP) 10.00.00.4036 on Windows XP SP2, Server 2003, and Server 2003 SP1 allows remote attackers to cause a denial of service (application crash) and execute arbitrary code via a long HREF attribute, using an unrecognized protocol, in a REF element in an ASX PlayList file.

Vulnerable Configurations

Part Description Count
Application
Microsoft
1

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Nessus

NASL familyWindows : Microsoft Bulletins
NASL idSMB_NT_MS06-78.NASL
descriptionThe remote host is running Windows Media Player/Series. There is a vulnerability in the remote version of this software which may allow an attacker to execute arbitrary code on the remote host. To exploit this flaw, one attacker would need to set up a rogue ASF/ASX file and send it to a victim on the remote host.
last seen2020-06-01
modified2020-06-02
plugin id23838
published2006-12-12
reporterThis script is Copyright (C) 2006-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/23838
titleMS06-078: Vulnerability in Windows Media Format Could Allow Remote Code Execution (923689/925398)
code
#
# Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
 script_id(23838);
 script_version("1.36");
 script_cvs_date("Date: 2018/11/15 20:50:30");

 script_cve_id("CVE-2006-4702", "CVE-2006-6134");
 script_bugtraq_id(21247, 21505);
 script_xref(name:"CERT", value:"208769");
 script_xref(name:"MSFT", value:"MS06-078");
 script_xref(name:"MSKB", value:"923689");

 script_name(english:"MS06-078: Vulnerability in Windows Media Format Could Allow Remote Code Execution (923689/925398)");
 script_summary(english:"Checks the version of Media Format");

 script_set_attribute(attribute:"synopsis", value:
"Arbitrary code can be executed on the remote host through the Media
Format Series.");
 script_set_attribute(attribute:"description", value:
"The remote host is running Windows Media Player/Series.

There is a vulnerability in the remote version of this software which
may allow an attacker to execute arbitrary code on the remote host.

To exploit this flaw, one attacker would need to set up a rogue ASF/ASX
file and send it to a victim on the remote host.");
 script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2006/ms06-078");
 script_set_attribute(attribute:"solution", value:
"Microsoft has released a set of patches for Windows 2000, XP and
2003.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");

 script_set_attribute(attribute:"vuln_publication_date", value:"2006/11/22");
 script_set_attribute(attribute:"patch_publication_date", value:"2006/12/12");
 script_set_attribute(attribute:"plugin_publication_date", value:"2006/12/12");

 script_set_attribute(attribute:"plugin_type", value:"local");
 script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
 script_end_attributes();

 script_category(ACT_GATHER_INFO);

 script_copyright(english:"This script is Copyright (C) 2006-2018 Tenable Network Security, Inc.");
 script_family(english:"Windows : Microsoft Bulletins");

 script_dependencies("smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
 script_require_keys("SMB/MS_Bulletin_Checks/Possible");
 script_require_ports(139, 445, 'Host/patch_management_checks');
 exit(0);
}

include("audit.inc");
include("smb_func.inc");
include("smb_hotfixes.inc");
include("smb_hotfixes_fcheck.inc");
include("misc_func.inc");

get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");

bulletin = 'MS06-078';
kb = '923689';

kbs = make_list(kb);
if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);

get_kb_item_or_exit("SMB/Registry/Enumerated");
get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);

if (hotfix_check_sp_range(win2k:'4,5', xp:'2,3', win2003:'0,1') <= 0) audit(AUDIT_OS_SP_NOT_VULN);

rootfile = hotfix_get_systemroot();
if (!rootfile) exit(1, "Failed to get the system root.");

share = hotfix_path2share(path:rootfile);
if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);

if ( hotfix_is_vulnerable(os:"5.2", sp:0, file:"Wmvcore.dll", version:"9.0.0.3265", min_version:"9.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb) ||
     hotfix_is_vulnerable(os:"5.2", arch:"x86", file:"Wmvcore.dll", version:"10.0.0.3708", min_version:"10.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb) ||
     hotfix_is_vulnerable(os:"5.2", file:"Dxmasf.dll", version:"6.4.9.1133", min_version:"6.4.0.0", dir:"\system32", bulletin:bulletin, kb:kb) ||
     hotfix_is_vulnerable(os:"5.1", file:"Wmvcore.dll", version:"9.0.0.3265", min_version:"9.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb) ||
     hotfix_is_vulnerable(os:"5.1", file:"Wmvcore.dll", version:"10.0.0.3702", min_version:"10.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb) ||
     hotfix_is_vulnerable(os:"5.1", file:"Dxmasf.dll", version:"6.4.9.1133", min_version:"6.4.0.0", dir:"\system32", bulletin:bulletin, kb:kb) ||
     hotfix_is_vulnerable(os:"5.0", file:"Wmvcore.dll", version:"7.10.0.3079", min_version:"7.10.0.0", dir:"\system32", bulletin:bulletin, kb:kb) ||
     hotfix_is_vulnerable(os:"5.0", file:"Wmvcore.dll", version:"9.0.0.3265", min_version:"9.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb) ||
     hotfix_is_vulnerable(os:"5.0", file:"Dxmasf.dll", version:"6.4.9.1133", min_version:"6.4.0.0", dir:"\system32", bulletin:bulletin, kb:kb) )
{
  set_kb_item(name:"SMB/Missing/"+bulletin, value:TRUE);
  hotfix_security_hole();

  hotfix_check_fversion_end();
  exit(0);
}
else
{
  hotfix_check_fversion_end();
  audit(AUDIT_HOST_NOT, 'affected');
}

Oval

accepted2015-08-10T04:01:07.155-04:00
classvulnerability
contributors
  • nameRobert L. Hollis
    organizationThreatGuard, Inc.
  • nameMaria Kedovskaya
    organizationALTX-SOFT
  • nameMaria Mikhno
    organizationALTX-SOFT
definition_extensions
  • commentWindows Media Format Runtime 7.1 is installed
    ovaloval:org.mitre.oval:def:29073
  • commentWindows Media Format Runtime 9.0 is installed
    ovaloval:org.mitre.oval:def:29023
  • commentWindows Media Format Runtime 9.5 is installed
    ovaloval:org.mitre.oval:def:28835
  • commentMicrosoft Windows XP SP2 or later is installed
    ovaloval:org.mitre.oval:def:521
  • commentWindows Media Format Runtime 9.5 is installed
    ovaloval:org.mitre.oval:def:28835
  • commentMicrosoft Windows Server 2003 is installed
    ovaloval:org.mitre.oval:def:128
  • commentWindows Media Format Runtime 9.5 is installed
    ovaloval:org.mitre.oval:def:28835
descriptionHeap-based buffer overflow in the WMCheckURLScheme function in WMVCORE.DLL in Microsoft Windows Media Player (WMP) 10.00.00.4036 on Windows XP SP2, Server 2003, and Server 2003 SP1 allows remote attackers to cause a denial of service (application crash) and execute arbitrary code via a long HREF attribute, using an unrecognized protocol, in a REF element in an ASX PlayList file.
familywindows
idoval:org.mitre.oval:def:669
statusaccepted
submitted2006-12-13T08:17:04
titleWindows Media Format ASX Parsing Vulnerability
version73

Seebug

bulletinFamilyexploit
descriptionMicrosoft Windows是微软发布的非常流行的操作系统。 Windows的Media Format的运行时库在处理包含畸形内容的ASF及ASX文件时存在漏洞，远程攻击者可能利用此漏洞完全控制用户机器。 如果用户浏览了恶意设置的网站或被诱骗打开了包含恶意内容的电子邮件，远程攻击者可能在用户机器上执行任意指令。 Microsoft Windows Media Player 6.4 Microsoft Windows Media Format 9.5 Series Runtime x64 Edition Microsoft Windows Media Format 7.1 - 9.5 Series Runtime 临时解决方法： 如果您不能立刻安装补丁或者升级，SEBUG建议您采取以下措施以降低威胁： * 在IE中设置禁用Media Player ActiveX控件 对于ASF文件处理漏洞（CVE-2006-4702） Windows Media Player 6.4 将如下的文本保存为 .reg 文件 Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}] &quot;Compatibility Flags&quot;=dword:00000400 双击此 .reg 文件应用到系统。 Windows Media Player 7.1, 9 和 10 将如下的文本保存为 .reg 文件 Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{6BF52A52-394A-11D3-B153-00C04F79FAA6}] &quot;Compatibility Flags&quot;=dword:00000400 双击此 .reg 文件应用到系统。 对于ASX文件处理漏洞（CVE-2006-6134） Windows Media Player 9 和 10 将如下的文本保存为 .reg 文件 Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{6BF52A52-394A-11D3-B153-00C04F79FAA6}] &quot;Compatibility Flags&quot;=dword:00000400 双击此 .reg 文件应用到系统。 厂商补丁： Microsoft --------- Microsoft已经为此发布了一个安全公告（MS06-078）以及相应补丁: MS06-078：Microsoft Security Bulletin MS06-078 链接：<a href="http://www.microsoft.com/technet/security/Bulletin/MS06-078.mspx" target="_blank">http://www.microsoft.com/technet/security/Bulletin/MS06-078.mspx</a>
idSSV:898
last seen2017-11-19
modified2006-12-13
published2006-12-13
reporterRoot
titleMicrosoft Windows Media Format运行时库远程任意指令执行漏洞（MS06-078）

References