{"id": "EDB-ID:20427", "type": "exploitdb", "bulletinFamily": "exploit", "title": "Microsoft Windows Media Player 7.0 - .asx Buffer Overflow Vulnerability", "description": "Microsoft Windows Media Player 7.0 .ASX Buffer Overflow Vulnerability. CVE-2000-1113. Remote exploit for windows platform", "published": "2000-11-22T00:00:00", "modified": "2000-11-22T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.exploit-db.com/exploits/20427/", "reporter": "@stake", "references": [], "cvelist": ["CVE-2000-1113"], "lastseen": "2016-02-02T14:14:05", "viewCount": 8, "enchantments": {"score": {"value": 7.2, "vector": "NONE", "modified": "2016-02-02T14:14:05", "rev": 2}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2000-1113"]}, {"type": "osvdb", "idList": ["OSVDB:1658"]}, {"type": "cert", "idList": ["VU:675320"]}], "modified": "2016-02-02T14:14:05", "rev": 2}, "vulnersScore": 7.2}, "sourceHref": "https://www.exploit-db.com/download/20427/", "sourceData": "source: http://www.securityfocus.com/bid/1980/info\r\n\r\nWindows Media Player is an application used for digital audio, and video content viewing. An unsafe buffer copy involving remotely-obtained data exists in the Active Stream Redirector (ASX) component in Windows Media Player. The ASX enables a user to play streaming media residing on an intranet or external site. .ASX files are metafiles that redirect streaming media content from a browser to Windows Media Player.\r\n\r\nThe contents of ASX files, when being interpreted by Windows Media Player, are copied into memory buffers for run-time use. When this data is copied, it is not ensured that the amount of data copied is within the predefined size limits. As a result, any extraneous data will be copied over memory boundaries and can overwrite neighbouring memory on the program's stack.\r\n\r\nDepending on the data that is copied, a denial of service attack could be launched or arbitrary code could be executed on the target host. Windows Media Player runs in the security context of the user currently logged on, therefore arbitrary code would be run at the privilege level of that particular user. If random data were entered into the buffer, the application would crash and restarting the application is required in order to regain normal functionality.\r\n\r\nIf a user was misled to download a hostile .ASX file to the local machine, they would only have to single click on the file within Windows Explorer to activate the code. This is due to the 'Web View' option that is used by Windows Explorer to preview web documents automatically while browsing (this feature is enabled by default). In addition, a malformed .ASX file could be embedded into a HTML document and be configured to execute when opened via a browser or HTML compliant email client.\r\n\r\nhttps://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/20427.zip", "osvdbidlist": ["1658"]}

{"cve": [{"lastseen": "2020-10-03T11:36:57", "description": "Buffer overflow in Microsoft Windows Media Player allows remote attackers to execute arbitrary commands via a malformed Active Stream Redirector (.ASX) file, aka the \".ASX Buffer Overrun\" vulnerability.", "edition": 3, "cvss3": {}, "published": "2001-01-09T05:00:00", "title": "CVE-2000-1113", "type": "cve", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": true, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2000-1113"], "modified": "2018-10-12T21:29:00", "cpe": ["cpe:/a:microsoft:windows_media_player:7", "cpe:/a:microsoft:windows_media_player:6.4"], "id": "CVE-2000-1113", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2000-1113", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:microsoft:windows_media_player:6.4:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:windows_media_player:7:*:*:*:*:*:*:*"]}], "osvdb": [{"lastseen": "2017-04-28T13:19:56", "bulletinFamily": "software", "cvelist": ["CVE-2000-1113"], "edition": 1, "description": "# No description provided by the source\n\n## References:\nMicrosoft Security Bulletin: MS00-090\nISS X-Force ID: 5574\n[CVE-2000-1113](https://vulners.com/cve/CVE-2000-1113)\nBugtraq ID: 1980\n", "modified": "2000-11-22T00:00:00", "published": "2000-11-22T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:1658", "id": "OSVDB:1658", "type": "osvdb", "title": "Microsoft Windows Media Player .ASX Buffer Overflow", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "cert": [{"lastseen": "2020-09-18T20:44:28", "bulletinFamily": "info", "cvelist": ["CVE-2000-1113"], "description": "### Overview \n\nThere is a buffer overflow in the parsing of Active Stream Redirector (.ASX) files. This buffer overflow may allow a remote attacker to execute arbitrary code when a user views a malicious web page.\n\n### Description \n\nThere is a buffer overflow in the processing of Active Stream Redirector (.ASX) files in Windows Media Player version 6.4 and 7. An Active Stream Redirector is a file type used by Windows Media Player to determine where a media stream can be found on the Internet, and how to play it.\n\nA newer variant of this vulnerability is described in VU#187528 and MS01-029. \n \n--- \n \n### Impact \n\nAn attacker may be able to execute arbitrary code on vulnerable systems when the user visits a web page. \n \n--- \n \n### Solution \n\n**Apply a Patch** \n \nMicrosoft has published patches correcting this vulnerability. The patches are listed in their advisory at: \n \n<http://www.microsoft.com/technet/security/bulletin/ms00-090.asp> \n \n--- \n \n### Vendor Information\n\n675320\n\nFilter by status: All Affected Not Affected Unknown\n\nFilter by content: __ Additional information available\n\n__ Sort by: Status Alphabetical\n\nExpand all\n\n**Javascript is disabled. Click here to view vendors.**\n\n### Microsoft Corporation __ Affected\n\nUpdated: July 16, 2002 \n\n### Status\n\nAffected\n\n### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Vendor Information \n\nThe vendor has not provided us with any further information regarding this vulnerability.\n\n### Addendum\n\nMicrosoft has published a security bulletin describing this vulnerability at:\n\n \n<http://www.microsoft.com/technet/security/bulletin/MS00-090.asp>\n\nIf you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:cert@cert.org?Subject=VU%23675320 Feedback>).\n\n \n\n\n### CVSS Metrics \n\nGroup | Score | Vector \n---|---|--- \nBase | | \nTemporal | | \nEnvironmental | | \n \n \n\n\n### References \n\n * <http://www.securityfocus.com/bid/1980>\n * <http://www.microsoft.com/technet/security/bulletin/ms00-090.asp>\n * <http://www.microsoft.com/technet/security/bulletin/fq00-090.asp>\n * <http://www.microsoft.com/technet/security/bulletin/MS01-029.asp>\n\n### Acknowledgements\n\nThanks to Ollie Whitehouse of @Stake for discovering this vulnerability.\n\nThis document was written by Cory F. Cohen.\n\n### Other Information\n\n**CVE IDs:** | [CVE-2000-1113](<http://web.nvd.nist.gov/vuln/detail/CVE-2000-1113>) \n---|--- \n**Severity Metric:** | 4.43 \n**Date Public:** | 2000-11-22 \n**Date First Published:** | 2002-09-27 \n**Date Last Updated: ** | 2002-09-27 17:47 UTC \n**Document Revision: ** | 16 \n", "modified": "2002-09-27T17:47:00", "published": "2002-09-27T00:00:00", "id": "VU:675320", "href": "https://www.kb.cert.org/vuls/id/675320", "type": "cert", "title": "Microsoft Windows Media Player buffer overflow in Active Stream Redirector (.asx) file parser", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}]}