|
|
Microsoft Media Player 9未授权媒体库访问漏洞
发布时间：2003-06-26
更新时间：2003-06-26
严重程度：低
威胁程度：用户敏感信息泄露
错误类型：设计错误
利用方式：客户机模式
BUGTRAQ ID：8034
受影响系统Microsoft Windows Media Player 9.0
+Microsoft Windows Server 2003 Datacenter Edition
+Microsoft Windows Server 2003 Datacenter Edition 64-bit
+Microsoft Windows Server 2003 Enterprise Edition
+Microsoft Windows Server 2003 Enterprise Edition 64-bit
+Microsoft Windows Server 2003 Standard Edition
+Microsoft Windows Server 2003 Web Edition 未影响系统Microsoft Windows Media Player XP
+Microsoft Windows XP Home
+Microsoft Windows XP Professional
Microsoft Windows Media Player 6.4
-Microsoft Windows 2000 Workstation
-Microsoft Windows 2000 Workstation SP1
-Microsoft Windows 2000 Workstation SP2
-Microsoft Windows 95
-Microsoft Windows 98
-Microsoft Windows NT 4.0
-Microsoft Windows NT 4.0 SP1
-Microsoft Windows NT 4.0 SP2
-Microsoft Windows NT 4.0 SP3
-Microsoft Windows NT 4.0 SP4
-Microsoft Windows NT 4.0 SP5
-Microsoft Windows NT 4.0 SP6
-Microsoft Windows NT 4.0 SP6a
Microsoft Windows Media Player 7.0
-Microsoft Windows 2000 Workstation
-Microsoft Windows 2000 Workstation SP1
-Microsoft Windows 2000 Workstation SP2
-Microsoft Windows 95
-Microsoft Windows 98
-Microsoft Windows NT 4.0
-Microsoft Windows NT 4.0 SP1
-Microsoft Windows NT 4.0 SP2
-Microsoft Windows NT 4.0 SP3
-Microsoft Windows NT 4.0 SP4
-Microsoft Windows NT 4.0 SP5
-Microsoft Windows NT 4.0 SP6
-Microsoft Windows NT 4.0 SP6a
Microsoft Windows Media Player 7.1
-Microsoft Windows 98
-Microsoft Windows ME
-Microsoft Windows NT 4.0
-Microsoft Windows NT 4.0 SP1
-Microsoft Windows NT 4.0 SP2
-Microsoft Windows NT 4.0 SP3
-Microsoft Windows NT 4.0 SP4
-Microsoft Windows NT 4.0 SP5
-Microsoft Windows NT 4.0 SP6
-Microsoft Windows NT 4.0 SP6a 详细描述
Windows Media Player 9的ActiveX控件对于请求没有做充分的检查，攻击者可能利用这个漏洞非法获取目标用户的媒体库信息，这些信息可能有助于对用户机器实施其他攻击，比如修改媒体的内容。
解决方案
厂商已经提供了补下：
Microsoft Windows Media Player 9.0:
Microsoft Patch Q819639
http://microsoft.com/downloads/details.aspx?FamilyId=36814221-8194- 4492-BB29-94DB3D4CB682&displaylang=en
相关信息
Microsoft Security Bulletin MS03-021
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-021.asp
|
