HTTP: Microsoft Windows Media Player Skin File Code Execution

This signature detects an HTTP server response that contains a malformed "Content-Disposition:" field. This response can cause a vulnerable Microsoft Internet Explorer client to download and execute an arbitrary file.

Extended Description

Windows Media Player is vulnerable to code execution through skin files. WMP does not properly validate URLs that are passed to initiate a skin file download and installation. This could allow a malicious file advertised as a skin file to be downloaded to a known location and executed through some other means.

Affected Products

Microsoft windows_media_player

References

BugTraq: 7517

CVE: CVE-2003-0228

URL: http://www.microsoft.com/technet/security/Bulletin/MS03-017.mspx http://www.securityfocus.com/archive/1/320811

Short Name

HTTP:STC:IE:WMP-SKIN-EXEC

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Microsoft Windows Media Player Skin File Code Execution

Extended Description

Affected Products

References

Found a potential security threat?