Microsoft Disputes Claim of Windows Media Player Vulnerability

Microsoft is denouncing a security researcher’s claim of a remote code execution flaw affecting Windows Media Player.

Reports of the vulnerability surfaced last week on the SecurityTracker vulnerability notification service. According to the initial report, a bug in Windows Media Player could be exploited remotely via a specially crafted SND, MIDI or WAV file to trigger an integer overflow. In that situation, the researcher alleged, a hacker could execute arbitrary code.

A subsequent posting on the SANS Internet Storm Center Web site over the weekend stated a reader had tested proof-of-concept code on a fully patched Windows XP Service Pack 3 system and caused Windows Media Player 9 and 11 to crash.

However, while Microsoft officials conceded the proof-of-concept code could trigger a crash, they found no possibility of arbitrary code execution.

“This particular crash is an unhandled CPU exception when executing a div instruction,” according to a post on the company’s Security Vulnerability Research and Defense blog. “When the processor executes a 'div reg' instruction, it does this: EAX = (EDX:EAX)/reg. If the result cannot fit on a 32 bit register it generates a CPU exception. This one is not handled by quartz.dll. There is no memory corruption here and the value does not appear to be used for any memory allocation. Rather, the operation is calculating a value related to the rate at which the media is to be played.”

According to Microsoft, the company has already addressed the issue in Windows Server 2003 SP2 and will fix it in other versions in the future.