Signature Detail

HTTP: Microsoft Windows Media Player Skin File Code Execution

This signature detects an HTTP server response that contains a malformed "Content-Disposition:" field. This response can cause a vulnerable Microsoft Internet Explorer client to download and execute an arbitrary file.

Extended Description

Windows Media Player is vulnerable to code execution through skin files. WMP does not properly validate URLs that are passed to initiate a skin file download and installation. This could allow a malicious file advertised as a skin file to be downloaded to a known location and executed through some other means.

Affected Products

• Microsoft Windows Media Player 7.1
• Microsoft Windows Media Player XP

References

• BugTraq: 7517
• CVE: CVE-2003-0228
• URL: http://www.microsoft.com/technet/security/Bulletin/MS03-017.mspx
• URL: http://www.securityfocus.com/archive/1/320811