National Cyber-Alert System

Vulnerability Summary for CVE-2006-0005

Overview

Buffer overflow in the plug-in for Microsoft Windows Media Player (WMP) 9 and 10, when used in browsers other than Internet Explorer and set as the default application to handle media files, allows remote attackers to execute arbitrary code via HTML with an EMBED element containing a long src attribute.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Technical Alert: TA06-045A

Name: TA06-045A

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA06-045A.html

US-CERT Vulnerability Note: VU#692060

Name: VU#692060

Hyperlink:http://www.kb.cert.org/vuls/id/692060

External Source: XF

Name: win-mediaplayer-plugin-embed-bo(24493)

Hyperlink:http://xforce.iss.net/xforce/xfdb/24493

External Source: BID

Name: 16644

Hyperlink:http://www.securityfocus.com/bid/16644

External Source: MS

Name: MS06-006

Hyperlink:http://www.microsoft.com/technet/security/bulletin/ms06-006.mspx

External Source: IDEFENSE

Name: 20060214 Microsoft Windows Media Player Plugin Buffer Overflow Vulnerability

Hyperlink:http://www.idefense.com/intelligence/vulnerabilities/display.php?id=393

External Source: VUPEN

Name: ADV-2006-0575

Type: Advisory

Hyperlink:http://www.frsirt.com/english/advisories/2006/0575

External Source: SECTRACK

Name: 1015628

Hyperlink:http://securitytracker.com/id?1015628

External Source: SECUNIA

Name: 18852

Type: Advisory

Hyperlink:http://secunia.com/advisories/18852

US Government Resource: oval:org.mitre.oval:def:1559

Name: oval:org.mitre.oval:def:1559

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1559