News
Vigil@nce: Windows Media Player, code execution
September 2008 by Vigil@nce
SYNTHESIS
An attacker can provide a malicious RTSP stream in order to execute code on computers of victims using Windows Media Player.
Gravity: 4/4
Consequences: user access/rights
Provenance: document
Means of attack: no proof of concept, no attack
Ability of attacker: expert (4/4)
Confidence: confirmed by the editor (5/5)
Diffusion of the vulnerable configuration: high (3/3)
Creation date: 10/09/2008
Identifier: VIGILANCE-VUL-8098
IMPACTED PRODUCTS
Microsoft Windows 2008
Microsoft Windows Vista [confidential versions]
Microsoft Windows XP [confidential versions]
DESCRIPTION
The Windows Media Player software can read SSPL (Server-Side Playlists) files provided by a RTSP (Real Time Streaming Protocol) server. Theses files can indicate audio or video files to play.
However, if Windows Media Player opens a malicious audio file received via SSPL, a memory corruption occurs.
An attacker can therefore provide a malicious RTSP stream in order to execute code on computers of victims using Windows Media Player.
CHARACTERISTICS
Identifiers: 954154, BID-30550, CVE-2008-2253, MS08-054, VIGILANCE-VUL-8098
