Microsoft Windows Media Player/Windows Media Center '.dvr-ms'文件代码执行漏洞

CVE编号

CVE-2011-0042

利用情况

暂无

补丁情况

N/A

披露时间

2011-03-10

漏洞描述

Microsoft Windows Media Player是一款流行的媒体播放程序; Microsoft Windows Media Services是一款流行的流媒体服务程序。在解析微软数字视频记录(.dvr-ms)媒体文件时Microsoft Windows Media Player/Windows Media Center提供的流缓冲引擎(SBE.dll)存在一个未明错误，远程攻击者可以利用此漏洞以应用进程上下文执行任意代码。

解决建议

用户可参考如下供应商提供的安全补丁：Microsoft Windows Vista Home Premium SP2Microsoft Windows6.1-KB2479943-x86.msuhttp://www.microsoft.com/downloads/details.aspx?familyid=1BE77DAA-29B1 -4DAE-A87F-2CB8F7E6A305Microsoft Windows XP Media Center Edition SP3Microsoft WindowsXP-KB2479943-x86-ENU.exehttp://www.microsoft.com/downloads/details.aspx?familyid=D8284BFA-ED6C -4647-9FB0-588E53173775Microsoft Windows XP Professional x64 Edition SP2Microsoft WindowsServer2003.WindowsXP-KB2479943-x64-ENU.exehttp://www.microsoft.com/downloads/details.aspx?familyid=5270B5D3-3720 -42A2-A8CF-67089C0CC658Microsoft Windows XP Tablet PC Edition SP3Microsoft WindowsXP-KB2479943-x86-ENU.exehttp://www.microsoft.com/downloads/details.aspx?familyid=D8284BFA-ED6C -4647-9FB0-588E53173775Microsoft Windows Vista SP1Microsoft Windows6.0-KB2479943-x86.msuhttp://www.microsoft.com/downloads/details.aspx?familyid=F9F1DDE2-2219 -4BF1-A497-EDD011577B96Microsoft Windows Vista SP2Microsoft Windows6.0-KB2479943-x86.msuhttp://www.microsoft.com/downloads/details.aspx?familyid=F9F1DDE2-2219 -4BF1-A497-EDD011577B96Microsoft Windows XP Home SP3Microsoft WindowsXP-KB2479943-x86-ENU.exehttp://www.microsoft.com/downloads/details.aspx?familyid=D8284BFA-ED6C -4647-9FB0-588E53173775Microsoft Windows Media Center TV Pack for Windows Vista 32-bit edition 0Microsoft Security Update for Windows Vista Media Center TVPack 2008 (KB2494132) http://www.microsoft.com/downloads/en/details.aspx?familyid=1BC240B3-1 938-4350-B26F-67B81A79F8A0&displaylang=en

参考链接
http://osvdb.org/71016
http://secunia.com/advisories/43626
http://www.securityfocus.com/bid/46680
http://www.securitytracker.com/id?1025169
http://www.us-cert.gov/cas/techalerts/TA11-067A.html
http://www.vupen.com/english/advisories/2011/0615
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-015
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	应用	microsoft	windows_media_center_tv_pack	*	-
	运行在以下环境
	应用	microsoft	windows_xp_media_center	2005	-

CVSS3评分 9.3

• 攻击路径 网络
• 攻击复杂度 N/A
• 权限要求 无
• 影响范围 N/A
• 用户交互 需要
• 可用性 完全地
• 保密性 完全地
• 完整性 完全地

AV:N/AC:M/Au:N/C:C/I:C/A:C CWE-ID 漏洞类型 CWE-20 输入验证不恰当