Title: Patch Available for
"Windows Media Player Skins File Download" Vulnerability
Date: February 14, 2001
Software: Windows Media Player 7
Impact: Run arbitrary code
Bulletin: MS01-010

Microsoft encourages customers to review the Security Bulletin at:
http://www.microsoft.com/technet/security/bulletin/MS01-010.asp.

Issue:

Windows Media Player 7 introduced a feature called "skins", that
allows customization of the look and feel of Windows Media Player. If
a Windows Media Player skin (.WMZ) file were downloaded from a
malicious web site it could potentially be used to run Java code to
read and browse files on a local machine. The vulnerability stems
from the fact that "skins" are downloaded to a known location on a
victim's computer and are stored in a .zip package. If the .zip
package contained a Java class (.class) file, any Java code in this
class could be executed under the local computer security zone.

If a Windows Media Player skin (.WMZ) file were downloaded from a
malicious web site, it could potentially cause the deployment of
zipped Java code to a known location on the visiting user's machine.
Since the Java code would reside in a known location on the machine,
script hosted on a hostile web site or embedded in a hostile HTML
mail message could potentially invoke the script in the local
computer security zone to take arbitrary action on the user's
machine.

Mitigating Factors:

• Disable the running of unsigned Java content
• Be wary of visiting malicious web sites or opening e-mail from
  unknown sources

Patch Availability:

• A patch is available to fix this vulnerability. Please read the
  Security Bulletin
  http://www.microsoft.com/technet/security/bulletin/ms01-010.asp
  for information on obtaining this patch.

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED
"AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL
WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT
SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY
DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO
THE FOREGOING LIMITATION MAY NOT APPLY.