CVE:CVE-2006-0005
CNNVD:CNNVD-200602-192
Microsoft Windows Media Player是一款非常流行的媒体播放器。
Windows Media layer(WMP)可在流行的浏览器中作为插件启动以便用户浏览网页上的Windows Media Player文件类型。
Microsoft Windows Media Player插件实现上存在缓冲区溢出漏洞，在某些环境下，远程攻击者可能利用此漏洞在用户机器上执行任意指令。一些非IE的浏览器(如FireFox和Netscape)中，Windows Media Player插件中的漏洞可以被触发，IE及Opera浏览器不受此漏洞影响。如果上述浏览器浏览嵌入了超长src标签的恶意HTML页面并启动WMP插件的话，可以覆盖SEH地址导致在系统中执行任意指令。具体来说，漏洞存在于npdsplay.10001040，在这里用户提供的字符串被拷贝到了栈缓冲区中：
 1000171A C1E9 02 SHR ECX，2
>> 1000171D F3:A5 REP MOVS DWORD PTR ES:[EDI]，DWORD PTR DS:[ESI]
 1000171F 8BC8 MOV ECX，EAX
solution:Upgrade microsoft windows-nt to a higher version than datacenter_server,datacenter_server:sp1,datacenter_server:sp2,datacenter_server:sp3,datacenter_server:sp4,xp:sp2,xp_tablet_pc,xp_tablet_pc:sp1,xp_tablet_pc:sp2,and avoid the version datacenter_server,datacenter_server:sp1,datacenter_server:sp2,datacenter_server:sp3,datacenter_server:sp4,xp:sp2,xp_tablet_pc,xp_tablet_pc:sp1,xp_tablet_pc:sp2; Upgrade microsoft windows_2000 to a higher version than *:sp1,*:sp2,*:sp3,*:sp4,-,and avoid the version *:sp1,*:sp2,*:sp3,*:sp4; Upgrade microsoft windows_2000_advanced_server to a higher version than *,sp1,sp2,sp3,sp4,and avoid the version sp1,sp2,sp3,sp4; Upgrade microsoft windows_2003_server to a higher version than datacenter_edition,datacenter_edition_64-bit,enterprise_edition,enterprise_edition_64-bit,standard,standard_64-bit,web_edition,and avoid the version datacenter_edition,datacenter_edition_64-bit,enterprise_edition,enterprise_edition_64-bit,standard,standard_64-bit,web_edition; Upgrade microsoft windows_server_2000 to a higher version than none,sp1,sp2,sp3,and avoid the version none,sp1,sp2,sp3; Upgrade microsoft windows_server_2003 to a higher version than datacenter_sp1,enterprise_sp1,standard_sp1,web_edition_sp1,and avoid the version datacenter_sp1,enterprise_sp1,standard_sp1,web_edition_sp1; Upgrade microsoft windows_xp to a higher version than *,*:sp1,*:sp2,-,and avoid the version *:sp1,*:sp2