Vulnerability

CERT-In Vulnerability Note CIVN-2011-0185
Microsoft Windows Media Player DVR-MS Memory Corruption Vulnerability

Original Issue Date:December 14, 2011

Severity Rating: HIGH

Systems Affected

Windows XP Media Center Edition 2005 Service Pack 3
Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 2
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1

Overview

A vulnerability has been reported in Microsoft Windows Media Player which could be exploited by remote attackers to execute arbitrary code on affected systems.

Description

The vulnerability is caused due to a memory corruption error while handling Microsoft Digital Video Recording (DVR-MS, .dvr-ms) files by Windows Media Player and Windows Media Center. An attacker who successfully exploited this vulnerability could run arbitrary code with the privileges of the currently logged-on user by tricking the victim into opening a specially crafted DVR-MS file.

Workaround

Restrict access to ENCDEC.DLL

Run the following command from a command prompt with appropriate privileges

For Windows XP (32-bit editions)
cacls %WINDIR%\SYSTEM32\ENCDEC.DLL /E /P everyone:N

For Windows XP (x64-based editions)
  cacls %WINDIR%\SYSWOW64\ENCDEC.DLL E /P everyone:N

For Windows Vista (32-bit editions) and Windows 7 (32-bit editions)
  takeown /f %WINDIR%\SYSTEM32\ENCDEC.DLL
  icacls %WINDIR%\SYSTEM32\ENCDEC.DLL /save %TEMP%\ENCDECDLL_ACL.TXT
  icacls %WINDIR%\SYSTEM32\ENCDEC.DLL /deny everyone:(F)

For Windows Vista (x64-based editions) and Windows 7 (x64-based editions)
  takeown /f %WINDIR%\SYSWOW64\ENCDEC.DLL
  icacls %WINDIR%\SYSWOW64\ENCDEC.DLL /save %TEMP%\ENCDECDLL_ACL.TXT
  icacls %WINDIR%\SYSWOW64\ENCDEC.DLL /deny everyone:(F)

Exercise caution while opening the files received unexpectedly from trusted sources.

Solution

Apply appropriate patches as mentioned in Microsoft Security Bulletin MS11-092

Vendor Information

Microsoft Corporations
http://technet.microsoft.com/en-us/security/bulletin/ms11-092

References

ISC SANS
http://isc.sans.org/diary/December+2011+Microsoft+Black+Tuesday+Summary/12193

SecurityTracker
http://www.securitytracker.com/id/1026407

Secunia
http://secunia.com/advisories/47117

CVE Name
CVE-2011-3401

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India