News

Critical Update Released for Windows Media Player

Microsoft alerted users Tuesday to a critical vulnerability in its Windows Media Player that could allow attackers to run the code of their choice on users' machines. A patch is available.

The problem affects Windows Media Player 6.4, a two-year-old version of the software. However, Microsoft notes that version 7.0 and the more recent 7.1 may be vulnerable due to backward compatibility efforts, and the company recommends that IT administrators patch 7.x-generation Windows Media Players as well.

Although the vulnerability could affect users of Windows XP, Microsoft says the issue is addressed by the Windows XP Critical Update that Redmond posted the day of the Windows XP launch (Oct. 25).

The vulnerability stems from an unchecked buffer in the code that processes Advanced Streaming Format (ASF).

An attacker would have to create a specially malformed ASF file and induce a user to play it. In some cases, the buffer overrun will merely cause Windows Media Player to crash. In other cases, the attacker could cause code to be executed on the machine with the user's privileges.

A mitigating factor is that the attacker must correctly guess the specific operating system the user is running for the attack to successfully execute any code on a user's machine.

The patch, the 56th this year, follows a recent and welcome trend out of Redmond in that it eliminates all known vulnerabilities affecting Windows Media Player 6.4.

Under Microsoft's new rating system, the risk is rated as critical over the Internet, intranet and for client systems.

The security bulletin about the vulnerability and link to the patch can be found at http://www.microsoft.com/technet/security/bulletin/ms01-056.asp.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.

Featured

  • Windows 10 Preview Adds Ability To Display Linux Distro Files

    Microsoft on Wednesday announced Windows 10 preview build 19603, which adds easier access to installed Linux distro files using Windows File Explorer.

  • Microsoft 365 Business To Get Azure Active Directory Premium P1 Perks

    Subscribers to Microsoft 365 Business (which is being renamed this month to "Microsoft 365 Business Premium") will be getting Azure Active Directory Premium P1 licensing at no additional cost.

  • How To Use .CSV Files with PowerShell, Part 1

    When it comes to bulk administration, few things are handier than .CSV files. In this two-part series, Brien demos his top techniques for working with .CSV files in PowerShell. First up: How to create a .CSV file.

  • SameSite Cookie Changes Rolled Back Until Summer

    The Chromium Project announced on Friday that it's delaying enforcement of SameSite cookie changes, and is temporarily rolling back those changes, because of the COVID-19 turmoil.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.