Windows Media Player PNG Chunk Decoding Stack-Based Buffer Overflow iDefense Security Advisory 06.13.06 http://www.idefense.com/application/poi/display?type=vulnerabilities June 13, 2006 I. BACKGROUND Windows Media Player is a video and audio file player for Windows based systems. It supports multiple file formats and allows playing files from either the local filesystem or the network. More information can be found at: http://www.microsoft.com/windows/windowsmedia/mp10/default.aspx II. DESCRIPTION Remote exploitation of a stack-based buffer overflow in the handling of PNG image file chunks by Microsoft Corp.'s Windows Media Player could allow attackers to execute arbitrary code. The Portable Network Graphics (PNG) specification defines an extensible, portable image format that gives lossless compression and allows transparency masking of various types. The format was developed as a patent-free alternative to GIF and TIFF format images, and the official specification is published on the W3C website. It should be noted that it is possible to cause Windows Media Player to be called as a 'helper application' in Internet Explorer and Mozilla browsers thus increasing the likelihood of exploitation. Windows Media Player uses a fixed-sized buffer in a function used when processing certain chunk types and no validation is performed on the length of the chunks this function is is passed. Therefore, a stack based buffer overflow can occur when WMP interprets a PNG file with an excessive chunk size. III. ANALYSIS Exploitation could allow a remote attacker to execute code in the context of the currently logged in user. In order to exploit this vulnerability, the victim must open a maliciously constructed file in Windows Media Player or follow a link in their browser to a website hosting such a file. No further user interaction is required for exploitation. In order to trigger this vulnerability, an attacker could construct a maliciously formed PNG file and link to it via an OBJECT tag on a website under their control. iDefense Labs has constructed a proof of concept exploit which achieved reliable code execution in both Internet Explorer and Mozilla Firefox. IV. DETECTION iDefense Labs has verified the existence of this vulnerability in version 10 of Microsoft Windows Media Player on Windows XP SP2 with all security patches installed as of May 23, 2006. Microsoft has reported that the following versions are affected: Windows Media Player 7.1 Windows Media Player for XP Windows Media Player 9 Microsoft Windows Media Player 10 V. WORKAROUND Any of the last three workarounds listed in the advisory for MS06-005 can be used to prevent exploitation. * Modify the Access Control List on the DirectX "Filter Graph no thread" registry key. * Backup and remove the DirectX "Filter Graph no thread" registry key. * Unregister Quartz.dll. Implementing these workarounds might prevent applications that use DirectX from functioning properly. This vulnerability is not the same as MS06-005, and the MS06-005 patches do not fix this vulnerability. The workarounds for that vulnerability are applicable here only because the vulnerability is in the same application and called in a similar manner. VI. VENDOR RESPONSE The vendor security advisory and appropriate patches are available at: http://www.microsoft.com/technet/security/Bulletin/MS06-024.mspx VII. CVE INFORMATION The Common Vulnerabilities and Exposures (CVE) project has assigned the name CAN-2006-0025 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. VIII. DISCLOSURE TIMELINE 02/22/2006 Initial vendor notification 02/22/2006 Initial vendor response 06/13/2006 Coordinated public disclosure IX. CREDIT This vulnerability was discovered by Greg MacManus, iDefense Labs. Get paid for vulnerability research http://www.idefense.com/poi/teams/vcp.jsp Free tools, research and upcoming events http://labs.idefense.com X. LEGAL NOTICES Copyright (c) 2006 iDefense, Inc. Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDefense. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please email customerservice@idefense.com for permission. Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/