The Members Forum

Microsoft today warned that the Windows Media Player that ships with every copy of its Windows operating system contains a critical vulnerability that could allow remote code execution if a user is tricked into opening a video file.

The disclosure forms part of this month’s Patch Tuesday release where Microsoft shipped three bulletins with patches for security holes in Windows and Microsoft Office.

The most serious of the three bulletins is MS11-015 and Microsoft is urging all Windows users to apply this update immediately because of the severity and the likelihood of working attack code within 30 days.

This security update resolves one publicly disclosed vulnerability in DirectShow and one privately reported vulnerability in Windows Media Player and Windows Media Center. The more severe of these vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Digital Video Recording (.dvr-ms) file. In all cases, a user cannot be forced to open the file; for an attack to be successful, a user must be convinced to do so.

The Windows Media update is rated “critical” for affected editions of Windows XP (including Windows XP Media Center Edition 2005); all supported editions of Windows Vista and Windows 7; and Windows Media Center TV Pack for Windows Vista.

The biggest problem exists in the way that Windows Media Player and Windows Media Center handle .dvr-ms files.

ZDnet has the details HERE!