MitreCVE-2006-6134

HistoryNov 28, 2006 - 1:07 a.m.

CVE-2006-6134

2006-11-2801:07:00

CWE-119

mitre

web.nvd.nist.gov

cve-2006-6134

buffer overflow

wmvcore.dll

windows media player

wmp 10

remote attackers

denial of service

arbitrary code execution

asx playlist

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

7.8

Confidence

High

EPSS

0.97

Percentile

99.8%

JSON

Heap-based buffer overflow in the WMCheckURLScheme function in WMVCORE.DLL in Microsoft Windows Media Player (WMP) 10.00.00.4036 on Windows XP SP2, Server 2003, and Server 2003 SP1 allows remote attackers to cause a denial of service (application crash) and execute arbitrary code via a long HREF attribute, using an unrecognized protocol, in a REF element in an ASX PlayList file.

Affected configurations

Nvd

Node

microsoftwindows_media_playerMatch10.00.00.4036

VendorProductVersionCPE
microsoftwindows_media_player10.00.00.4036cpe:2.3:a:microsoft:windows_media_player:10.00.00.4036:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	windows_media_player	10.00.00.4036	cpe:2.3:a:microsoft:windows_media_player:10.00.00.4036:::::::*

References

blogs.technet.com/msrc/archive/2006/12/07/public-proof-of-concept-code-for-asx-file-format-isssue.aspx

research.eeye.com/html/alerts/zeroday/20061122.html

secunia.com/advisories/22971

securityreason.com/securityalert/1922

securitytracker.com/id?1017354

support.avaya.com/elmodocs2/security/ASA-2006-274.htm

www.kb.cert.org/vuls/id/208769

www.securityfocus.com/archive/1/452352/100/0/threaded

www.securityfocus.com/archive/1/453579/100/0/threaded

www.securityfocus.com/archive/1/454969/100/200/threaded

www.securityfocus.com/bid/21247

www.us-cert.gov/cas/techalerts/TA06-346A.html

www.vupen.com/english/advisories/2006/4882

docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-078

oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A669

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

7.8

Confidence

High

EPSS

0.97

Percentile

99.8%

JSON

Related for CVE-2006-6134