This is a cumulative patch that includes the functionality of all previously released patches for Windows Media Player 6.4, 7.1 and Windows Media Player for Windows XP. In addition, it eliminates the three newly discovered vulnerabilities, one of which is rated as critical severity, one of which is rated moderate severity, and the last of which is rated low severity: Press Read More for further info.
An information disclosure vulnerability that could provide the means to enable an attacker to run code on the user's system and is rated as critical severity. A privilege elevation vulnerability that could enable an attacker who can physically logon locally to a Windows 2000 machine and run a program to obtain the same rights as the operating system. A script execution vulnerability related that could run a script of an attacker's choice as if the user had chosen to run it after playing a specially formed media file and then viewing a specially constructed web page. This particular vulnerability has specific timing requirements that makes attempts to exploit vulnerability difficult and is rated as low severity. It also introduces a configuration change relating to file extensions associated with Windows Media Player. Finally, it introduces a new, optional, security configuration feature for users or organizations that want to take extra precautn physically logon locally to a Windows 2000 machine and run a program to obtain the same rights as the operating system. A script execution vulnerability related that could run a script of an attacker's choice as if the user had chosen to run it after playing a specially formed media file and then viewing a specially constructed web page. This particular vulnerability has specific timing requirements that makes attempts to exploit vulnerability difficult and is rated as low severity. It also introduces a configuration change relating to file extensions associated with Windows Media Player. Finally, it introduces a new, optional, security configuration feature for users or organizations that want to take extra precautions beyond applying IE patch MS02-023 and want to disable scripting functionality in the Windows Media Player for versions 7.x or higher. Mitigating factors: Cache Patch Disclosure via Windows Media Player: Customers who have applied MS02-023 are protected against attempts to automatically exploit this issue through HTML email when they read email in the Restricted Sites zone. Outlook 98 and Outlook 2000 with the Outlook Email Security Update, Outlook 2002 and Outlook Express 6.0 all read email in the Restricted Sites zone by default. The vulnerability does not affect media files opened from the local machine. As a result of this, users who download and save files locally are not affected by attempts to exploit this vulnerability. Privilege Elevation through Windows Media Device Manager Service: This issue affects only Windows Media Player 7.1 it does not affect Windows Media Player for Windows XP nor Windows Media Player 6.4. The vulnerability only affects Windows Media Player 7.1 when run on Windows 2000, it does not impact systems that have no user security model such as Windows 98 or Windows ME systems. This issue only affects console sessions; users who logon via terminal sessions cannot exploit this vulnerability. An attacker must be able to load and run a program on the system. Anything that prevents an attacker from loading or running a program could protect against attempts to exploit this vulnerability. Media Playback Script Invocation: A successful attack requires a specific series of actions follows in exact order, otherwise the attack will fail. Specifically: A user must play a specially formed media file from an attacker. After playing the file, the user must shut down Windows Media Player without playing another file. The user must then view a web page constructed by the attacker. Severity Rating: Cache Patch Disclosure via Windows Media Player: Internet Servers Intranet Servers Client Systems Windows Media Player 6.4 Low Low Critical Windows Media Player 7.1 Low Low Critical Windows Media Player for Windows XP Low Low Critical Privilege Elevation through Windows Media Device Manager Service: Internet Servers Intranet Servers Client Systems Windows Media Player 6.4 None None None Windows Media Player 7.1 on Windows 2000 Low Low Critical Windows Media Player 7.1 all other platforms None None None Windows Media Player for Windows XP None None None Media Playback Script Invocation: Internet Servers Intranet Servers Client Systems Windows Media Player 6.4 None None None Windows Media Player 7.1 Low Low Low Windows Media Player for Windows XP None None None Aggregate Severity of all issues included in this patch (including issues addressed in previously released patches): Internet Servers Intranet Servers Client Systems Windows Media Player 6.4 Critical Critical Critical Windows Media Player 7.1 Critical Critical Critical Windows Media Player for Windows XP None None Critical The above assessment is based on the types of systems affected by the vulnerability, their typical deployment patterns, and the effect that exploiting the vulnerability would have on them. The License Handling cache disclosure vulnerability could be used to run code on the system as the user. The Privilege Elevation through Windows Media Device Manager Service requires the ability to logon at the console: terminal sessions are not affected. In addition, the attacker must be able to load and run a program. The Media Playback Script Invocation vulnerability has specific timing requirements that make an automated attack difficult to accomplish. Vulnerability identifier: Cache Patch Disclosure via Windows Media Player: CAN-2002-0372 Privilege Elevation through Windows Media Device Manager Service: CAN-2002-0373 Media Playback Script Invocation: CAN-2002-0615 Tested Versions:
Microsoft tested Windows Media Player 6.4, 7.1 and Windows Media Player for Windows XP to assess whether they are affected by this vulnerability. Previous versions are no longer supported, and may or may not be affected by these vulnerabilities. News Source: Microsoft
Direct Link: Cumulative Patch for Windows Media Player (Q320920)
Download Link: Download to Store - 1.1 MB - WMP 6.4
Download Link: Download to Store - 1.1 MB - WMP 7.1
Download Link: Download to Store - 1.1 MB - WMP 8.0 (Windows XP Version)
Windows Update V4: Internet Automatic Installation
An information disclosure vulnerability that could provide the means to enable an attacker to run code on the user's system and is rated as critical severity. A privilege elevation vulnerability that could enable an attacker who can physically logon locally to a Windows 2000 machine and run a program to obtain the same rights as the operating system. A script execution vulnerability related that could run a script of an attacker's choice as if the user had chosen to run it after playing a specially formed media file and then viewing a specially constructed web page. This particular vulnerability has specific timing requirements that makes attempts to exploit vulnerability difficult and is rated as low severity. It also introduces a configuration change relating to file extensions associated with Windows Media Player. Finally, it introduces a new, optional, security configuration feature for users or organizations that want to take extra precautn physically logon locally to a Windows 2000 machine and run a program to obtain the same rights as the operating system. A script execution vulnerability related that could run a script of an attacker's choice as if the user had chosen to run it after playing a specially formed media file and then viewing a specially constructed web page. This particular vulnerability has specific timing requirements that makes attempts to exploit vulnerability difficult and is rated as low severity. It also introduces a configuration change relating to file extensions associated with Windows Media Player. Finally, it introduces a new, optional, security configuration feature for users or organizations that want to take extra precautions beyond applying IE patch MS02-023 and want to disable scripting functionality in the Windows Media Player for versions 7.x or higher. Mitigating factors: Cache Patch Disclosure via Windows Media Player: Customers who have applied MS02-023 are protected against attempts to automatically exploit this issue through HTML email when they read email in the Restricted Sites zone. Outlook 98 and Outlook 2000 with the Outlook Email Security Update, Outlook 2002 and Outlook Express 6.0 all read email in the Restricted Sites zone by default. The vulnerability does not affect media files opened from the local machine. As a result of this, users who download and save files locally are not affected by attempts to exploit this vulnerability. Privilege Elevation through Windows Media Device Manager Service: This issue affects only Windows Media Player 7.1 it does not affect Windows Media Player for Windows XP nor Windows Media Player 6.4. The vulnerability only affects Windows Media Player 7.1 when run on Windows 2000, it does not impact systems that have no user security model such as Windows 98 or Windows ME systems. This issue only affects console sessions; users who logon via terminal sessions cannot exploit this vulnerability. An attacker must be able to load and run a program on the system. Anything that prevents an attacker from loading or running a program could protect against attempts to exploit this vulnerability. Media Playback Script Invocation: A successful attack requires a specific series of actions follows in exact order, otherwise the attack will fail. Specifically: A user must play a specially formed media file from an attacker. After playing the file, the user must shut down Windows Media Player without playing another file. The user must then view a web page constructed by the attacker. Severity Rating: Cache Patch Disclosure via Windows Media Player: Internet Servers Intranet Servers Client Systems Windows Media Player 6.4 Low Low Critical Windows Media Player 7.1 Low Low Critical Windows Media Player for Windows XP Low Low Critical Privilege Elevation through Windows Media Device Manager Service: Internet Servers Intranet Servers Client Systems Windows Media Player 6.4 None None None Windows Media Player 7.1 on Windows 2000 Low Low Critical Windows Media Player 7.1 all other platforms None None None Windows Media Player for Windows XP None None None Media Playback Script Invocation: Internet Servers Intranet Servers Client Systems Windows Media Player 6.4 None None None Windows Media Player 7.1 Low Low Low Windows Media Player for Windows XP None None None Aggregate Severity of all issues included in this patch (including issues addressed in previously released patches): Internet Servers Intranet Servers Client Systems Windows Media Player 6.4 Critical Critical Critical Windows Media Player 7.1 Critical Critical Critical Windows Media Player for Windows XP None None Critical The above assessment is based on the types of systems affected by the vulnerability, their typical deployment patterns, and the effect that exploiting the vulnerability would have on them. The License Handling cache disclosure vulnerability could be used to run code on the system as the user. The Privilege Elevation through Windows Media Device Manager Service requires the ability to logon at the console: terminal sessions are not affected. In addition, the attacker must be able to load and run a program. The Media Playback Script Invocation vulnerability has specific timing requirements that make an automated attack difficult to accomplish. Vulnerability identifier: Cache Patch Disclosure via Windows Media Player: CAN-2002-0372 Privilege Elevation through Windows Media Device Manager Service: CAN-2002-0373 Media Playback Script Invocation: CAN-2002-0615 Tested Versions:
Microsoft tested Windows Media Player 6.4, 7.1 and Windows Media Player for Windows XP to assess whether they are affected by this vulnerability. Previous versions are no longer supported, and may or may not be affected by these vulnerabilities. News Source: Microsoft
Direct Link: Cumulative Patch for Windows Media Player (Q320920)
Download Link: Download to Store - 1.1 MB - WMP 6.4
Download Link: Download to Store - 1.1 MB - WMP 7.1
Download Link: Download to Store - 1.1 MB - WMP 8.0 (Windows XP Version)
Windows Update V4: Internet Automatic Installation
