MS10-027

Executive Summary

Summary
Title	Vulnerability in Windows Media Player Could Allow Remote Code Execution (979402)

Informations
Name	MS10-027	First vendor Publication	2010-04-13
Vendor	Microsoft	Last vendor Modification	2010-04-13
Severity (Vendor)	Critical	Revision	1.0

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score	9.3	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentification	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Revision Note: V1.0 (April 13, 2010): Bulletin published.

Summary: This security update resolves a privately reported vulnerability in Windows Media Player. The vulnerability could allow remote code execution if Windows Media Player opened specially crafted media content hosted on a malicious Web site. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Original Source

Url : http://www.microsoft.com/technet/security/bulletin/MS10-027.mspx

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:7281

Oval ID:	oval:org.mitre.oval:def:7281
Title:	Media Player Remote Code Execution Vulnerability
Description:	Unspecified vulnerability in the Windows Media Player ActiveX control in Windows Media Player (WMP) 9 on Microsoft Windows 2000 SP4 and XP SP2 and SP3 allows remote attackers to execute arbitrary code via crafted media content, aka "Media Player Remote Code Execution Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2010-0268	Version:	3
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP	Product(s):	Windows Media Player 9
Definition Synopsis:
Windows Media Player 9 on Windows 2000, XP SP2 Windows Media Player v9.0 is installed. Microsoft Windows 2000 SP4 or later is installed AND Microsoft Windows XP (x86) SP2 is installed AND the version of Wmp.dll is less than 9.0.0.3367 AND Windows Media Player 9 on Windows XP SP3 Windows Media Player v9.0 is installed. AND Microsoft Windows XP (x86) SP3 is installed AND the version of Wmp.dll is less than 9.0.0.4508

CPE : Common Platform Enumeration

Type	Description	Count
Application	Microsoft Windows Media Player cpe:/a:microsoft:windows_media_player:9	1
Os	Microsoft Windows 2000 cpe:/o:microsoft:windows_2000::sp4	1
Os	Microsoft Windows Xp cpe:/o:microsoft:windows_xp::sp2 cpe:/o:microsoft:windows_xp::sp3	2