Check Point Advisories

Microsoft Windows Media Player Skin Decompression Code Execution (CVE-2007-3035)

Check Point Reference: CPAI-2007-310
Date Published: 27 Jul 2010
Severity: High
Last Updated: Tuesday 27 July, 2010
Source:
Industry Reference:CVE-2007-3035
Protection Provided by:

Security Gateway
R81, R80, R77, R75
Who is Vulnerable?
Vulnerability Description Microsoft Windows Media Player (WMP) is a popular multi-media application bundled with recent versions of the Microsoft Windows operating system. The application supports the playback of numerous video, audio, and image formats, as well as the playback of streaming content from remote sources. To enhance the flexibility of the application, Microsoft has implemented a Skin selection mechanism that allows the users to change the look of the application's Graphical User Interface (GUI). There exists a code execution vulnerability in Microsoft Windows Media Player. The vulnerability is caused due to a boundary error when decompressing the encoded data from WMZ and WMD files. A remote attacker can exploit this vulnerability by enticing the target user to open crafted WMZ and WMD files, potentially causing arbitrary code to be injected and executed in the security context of the currently logged in user. In a simple attack case, the affected Windows Media Player may terminate when the malicious page is opened. In a sophisticated attack scenario, where the malicious user is successful in injecting and executing supplied code, the behavior of the system is dependent on the nature of the injected code. Any code injected into the vulnerable component would execute in the security context of the currently logged in user.

Protection Overview

This protection will detect and block attempts to exploit this vulnerability.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

  1. In the IPS tab, click Protections and find the Microsoft Windows Media Player Skin Decompression Code Execution protection using the Search tool and Edit the protection's settings.
  2. Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name:  Media Player Enforcement Violation.
Attack Information:  Microsoft Windows Media Player Skin decompression code execution

×
  Feedback
This website uses cookies for its functionality and for analytics and marketing purposes. By continuing to use this website, you agree to the use of cookies. For more information, please read our Cookies Notice.
OK