Windows Media Player PNG Chunk Decoding Stack-Based Buffer Overflow

I. BACKGROUND

Windows Media Player is a video and audio file player for Windows based
systems. It supports multiple file formats and allows playing files from
either the local filesystem or the network. More information can be
found at:

http://www.microsoft.com /windows/windowsmedia/mp10/default.aspx

II. DESCRIPTION

Remote exploitation of a stack-based buffer overflow in the handling of
PNG image file chunks by Microsoft Corp.'s Windows Media Player could
allow attackers to execute arbitrary code.

The Portable Network Graphics (PNG) specification defines an extensible,
portable image format that gives lossless compression and allows
transparency masking of various types. The format was developed as a
patent-free alternative to GIF and TIFF format images, and the official
specification is published on the W3C website. It should be noted that
it is possible to cause Windows Media Player to be called as a 'helper
application' in Internet Explorer and Mozilla browsers thus increasing
the likelihood of exploitation.

Windows Media Player uses a fixed-sized buffer in a function used when
processing certain chunk types and no validation is performed on the
length of the chunks this function is is passed. Therefore, a stack
based buffer overflow can occur when WMP interprets a PNG file with an
excessive chunk size.

III. ANALYSIS

Exploitation could allow a remote attacker to execute code in the
context of the currently logged in user. In order to exploit this
vulnerability, the victim must open a maliciously constructed file in
Windows Media Player or follow a link in their browser to a website
hosting such a file. No further user interaction is required for
exploitation.

In order to trigger this vulnerability, an attacker could construct a
maliciously formed PNG file and link to it via an OBJECT tag on a
website under their control.

iDefense Labs has constructed a proof of concept exploit which achieved
reliable code execution in both Internet Explorer and Mozilla Firefox.

IV. DETECTION

iDefense Labs has verified the existence of this vulnerability in
version 10 of Microsoft Windows Media Player on Windows XP
SP2 with all security patches installed as of May 23, 2006.

Microsoft has reported that the following versions are affected:

Windows Media Player 7.1
Windows Media Player for XP
Windows Media Player 9
Microsoft Windows Media Player 10

V. WORKAROUND

Any of the last three workarounds listed in the advisory for MS06-005
can be used to prevent exploitation.

    * Modify the Access Control List on the DirectX "Filter Graph no
      thread" registry key.
    * Backup and remove the DirectX "Filter Graph no thread" registry
      key.
    * Unregister Quartz.dll.

Implementing these workarounds might prevent applications that use
DirectX from functioning properly.

This vulnerability is not the same as MS06-005, and the MS06-005 patches
do not fix this vulnerability. The workarounds for that vulnerability
are applicable here only because the vulnerability is in the same
application and called in a similar manner.

VI. VENDOR RESPONSE

The vendor security advisory and appropriate patches are available at:

http://www.microsoft.com/technet/security/Bulletin/MS06-024.mspx

VII. CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CAN- 2006-0025 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org), which standardizes names for
security problems.

VIII. DISCLOSURE TIMELINE

02/22/2006 Initial vendor notification
02/22/2006 Initial vendor response
06/13/2006 Coordinated public disclosure

IX. CREDIT

This vulnerability was discovered by Greg MacManus, iDefense Labs.

Get paid for vulnerability research
http://www.idefense.com/poi/teams/vcp.jsp

Free tools, research and upcoming events
http://labs.idefense.com

X. LEGAL NOTICES

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDefense. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.