[NT] Windows Media Player BMP Buffer Overflow (MS06-005)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Windows Media Player BMP Buffer Overflow (MS06-005)
------------------------------------------------------------------------


SUMMARY

Microsoft Media Player allows to reliably overwrite heap memory with
user-controlled data and execute arbitrary code in the context of the user
who executed the player.

DETAILS

Vulnerable Systems:
* Windows Media Player for XP on Microsoft Windows XP Service Pack 1
* Windows Media Player 9 on Microsoft Windows XP Service Pack 2
* Windows Media Player 9 on Microsoft Windows Server 2003
* Microsoft Windows 98
* Microsoft Windows 98 Second Edition (SE)
* Microsoft Windows Millennium Edition (ME)
* Microsoft Windows Media Player 7.1 when installed on Windows 2000
Service Pack 4
* Microsoft Windows Media Player 9 when installed on Windows 2000 Service
Pack 4 or Windows XP Service Pack 1
* Microsoft Windows Media Player 10 when installed on Windows XP Service
Pack 1 or Windows XP Service Pack 2

Immune Systems:
* Windows Media Player 6.4 on all Microsoft Windows operating systems
* Windows Media Player 10 on Microsoft Windows Server 2003 Service Pack 1
* Microsoft Windows XP Professional x64 Edition
* Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft
Windows Server 2003 with SP1 for Itanium-based Systems
* Microsoft Windows Server 2003 x64 Edition

Windows Media Player can play bitmap format files, such as a .bmp file and
use Windows Media Player (WMP) to decode a dll process of a .bmp file.
If a bitmap file declears with a size of 0, Windows Media Player is unable
to handle the bitmap currectly.
In this case, WMP will allocate a heap size of 0 bytes, but it will copy
the heap with the real file length. A specially crafted bitmap file that
declares it's size as 0 will cause the the buffer overflow. When changing
the size to 0 bytes, WMP will allocate the heap of the new function, so
actually it will allocate 0x2*8(heap) sized heap. When it copy the date it
will check two conditions:

1. Less than the size - the bmp head, this is 0-0xe(the bmp head size) =
0xfffffff2
2. Less than 0x1000

So if the real file size is less than 0x1000, it will copy the real date
size to the 0x2*8 heap, if the real file size is larger than 0x1000, it
will copy the first 0x1000 to the 0x2*8 heap.

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0006>
CVE-2006-0006


ADDITIONAL INFORMATION

The information has been provided by <mailto:Advisories@xxxxxxxx> eEye
Advisories .
The original article can be found at:
<http://www.eeye.com/html/research/advisories/AD20060214.html>
http://www.eeye.com/html/research/advisories/AD20060214.html
The vendor advisory can be found at:
<http://www.securiteam.com/windowsntfocus/5DP0G1FHPS.html>
http://www.securiteam.com/windowsntfocus/5DP0G1FHPS.html



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages