Description
Heap-based buffer overflow in the bitmap processing routine in Microsoft Windows Media Player 7.1 on Windows 2000 SP4, Media Player 9 on Windows 2000 SP4 and XP SP1, and Media Player 10 on XP SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted bitmap (.BMP) file that specifies a size of 0 but contains additional data.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 2
- Microsoft Windows Media Player 7.1 < 10 - '.BMP' Heap Overflow (MS06-005) (2) EDB-1502 · remote · Feb 16, 2006 · verified
- Microsoft Windows Media Player 7.1 < 10 - '.BMP' Heap Overflow (PoC) (MS06-005) (1) EDB-1500 · dos · Feb 15, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- oval:org.mitre.oval:def:1256 vdb-entry signature
- oval:org.mitre.oval:def:1578 vdb-entry signature
- ADV-2006-0574 vdb-entry
- 20060214 [EEYEB-20051017] Windows Media Player BMP Heap Overflow mailing-list
- 16633 vdb-entry
- 423 third-party-advisory
- TA06-045A third-party-advisory
- 1015627 vdb-entry
- VU#291396 third-party-advisory
- http://www.eeye.com/html/research/advisories/AD20060214.html
- 20060215 Windows Media Player BMP Heap Overflow (MS06-005) mailing-list
- win-media-player-bmp-bo(24488) vdb-entry
- MS06-005 vendor-advisory
- 18835 third-party-advisory
- oval:org.mitre.oval:def:1598 vdb-entry signature
- oval:org.mitre.oval:def:1661 vdb-entry signature