News

Critical Flaw Found in Windows Media Player

Officially, your users shouldn't be downloading Windows Media Player skins at work. Realistically, some of them probably are, and it's worthwhile to pay attention to a critical new security vulnerability patched by Microsoft Wednesday night.

The bulletin, Microsoft's 17th of 2003, fixes a flaw that could allow an attacker to run arbitrary code on computers running Windows Media Player 7.1 or Windows Media Player for Windows XP (version 8.0). Windows Media Player 9 Series isn't affected by the issue. Other versions aren't supported and weren't tested.

"Skins" are custom overlays that change the appearance of Windows Media Player. While the product ships with some skins already, it also allows third parties to create and distribute their own, and that's where the flaw comes in.

"A flaw exists in the way Windows Media Player 7.1 and Windows Media Player for Windows XP handle the download of skin files. The flaw means that an attacker could force a file masquerading as a skin file into a known location on a user’s machine. This could allow an attacker to place a malicious executable on the system," the Microsoft bulletin notes.

Microsoft Security Bulletin MS03-017 is available at www.microsoft.com/technet/security/bulletin/MS03-017.asp.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.

Featured

  • Microsoft Warns IT Pros on Windows Netlogon Fix Coming Next Month

    Microsoft on Thursday issued a reminder to organizations to ensure that their systems are properly patched for a "Critical"-rated Windows Netlogon vulnerability before next month's "update Tuesday" patch distribution arrives.

  • Microsoft Nudging Skype for Business Users to Teams

    Microsoft on Thursday announced some perks and prods for Skype for Business unified communications users, with the aim of moving them to the Microsoft Teams collaboration service instead.

  • How To Improve Windows 10's Sound and Video Quality

    Windows 10 comes with built-in tools that can help users get the most out of their sound and video hardware.

  • Microsoft Offers More 'Solorigate' Advice Using Microsoft 365 Defender Tools

    Microsoft issued yet another article with advice on how to use its Microsoft 365 Defender suite of tools to protect against "Solorigate" advanced persistent threat types of attacks in a Thursday announcement.

comments powered by Disqus