Comments on: Backdooring Windows Media Files

By: Firefox won’t save you. Well, sorta. | Matt Frye dot Net

Firefox won’t save you. Well, sorta. | Matt Frye dot Net — Thu, 10 Jan 2008 16:26:31 +0000

[...] article about a someone else’s blog post points out that Firefox won’t save you from attacks launched into IE from other crappy [...]

By: ASX plus ClickOnce: Dangerous Combination | GNUCITIZEN

ASX plus ClickOnce: Dangerous Combination | GNUCITIZEN — Mon, 05 Nov 2007 12:52:06 +0000

[...] about video format attacks before (QTL, MOV, MPGs, etc, etc, etc) and in particular covered the ASX file format and the dangerous applications it can be used for. Having my previous posts in mind, I would like [...]

By: crypt1c_cyph3r

crypt1c_cyph3r — Fri, 26 Oct 2007 22:11:19 +0000

Hello, everyone just want to say thanx for this info really appreciate the insight! I’m honestly fed up with MS(I call em MicroSh1t)! i’m just about ready to switch over to linux! u know ubuntu, just as soon as i can figure out how to get my internet connection up and running with it! just need a little help with the drivers i need and how to install them on ubuntu’s linux os! i am using a Motorola SURFboard SB5120 USB Cable Modem and my isp is cox high speed internet! any help any1 could give me is much appreciated.

as i’m kinda new to the linux os!

By: IT Security » Blog Archive » Free Music That’s Legal — But Is It Safe?

Thu, 25 Oct 2007 18:16:12 +0000

[...] are also backdoor vulnerabilities associated with Windows Media Files. GnuCitizen.org has the details — essentially, the meta files used to create playlists are in XML format, the [...]

By: 0xDeadFace

0xDeadFace — Tue, 25 Sep 2007 21:57:17 +0000

I read and code your exploit but I’m missing something: the jscript you launch in wmp works well in an html file opened directly with ie. I mean: no need to use this wmp trick.

The advantage of your exploit is that you use the less restrictive security rules of wmp than ie for executing jscript. Correct?

May you put an example with such a jscript?

thx

By: CX

CX — Tue, 25 Sep 2007 15:07:47 +0000

No problem: try lite version WinXP SP2 Vista edition (175 Mb.) _WITHOUT WINDOWS MEDIA PLAYER_

:))

By: QuixoBlog » Nuovo Bug in WMP

QuixoBlog » Nuovo Bug in WMP — Tue, 25 Sep 2007 08:02:05 +0000

[...] forse in transagosistica, e dopo aver scoperto la falla relativa al binomio QuickTime + Firefox, ne segnala oggi una nuova, riguardante Windows Media Player. Un file multimediale creato a puntino potrebbe [...]

By: Vulnerabilidad en Adobe Reader compromete a Windows | LKernelPanic

Vulnerabilidad en Adobe Reader compromete a Windows | LKernelPanic — Sat, 22 Sep 2007 01:10:05 +0000

[...] llama la atenciÃ³n el estar cazando bugs, sin embargo ya van 3 de forma seguida, el del Quicktime, uno del WMP (Windows Media Player) y ahora, uno de Adobe Reader, en menos de una [...]

By: Sergey Gordeychik

Sergey Gordeychik — Fri, 21 Sep 2007 09:45:23 +0000

There are lot of other applications which use IE as default rendering engine and can used to exploit IE’s bugs. But via different vectors.

Examples:

http://seclists.org/bugtraq/2005/Jul/0427.html

http://www.securitylab.ru/contest/212127.php (Russian)
http://www.securityfocus.com/bid/17913/references

By: Lff

Lff — Fri, 21 Sep 2007 07:17:54 +0000

Guys, no one ever thought that windows itself and microsoft as a company are free from bugs and security holes… In general, microsoft is sucks by itself, no less no more. Everybosy, let us say: “Bill, we do not want your sloppy company anymore!”

By: hackademix.net Â» Don't Open That Doc!

hackademix.net Â» Don't Open That Doc! — Thu, 20 Sep 2007 23:58:44 +0000

[...] seen MP3 tunes pwning Firefox (and NoScript promptly counter-pwning), Windows playlists pwning browser security, and finally PDF documents pwning Windows PCs. This latest “disclosure” sounds like a [...]

By: World News Soft Year » Blog Archive » Ð”Ñ‹Ñ€Ñ‹ Ð² IE Ð¼Ð¾Ð¶Ð½Ð¾ Ð·Ð°Ð´ÐµÐ¹ÑÑ‚Ð²Ð¾Ð²Ð°Ñ‚ÑŒ Ñ‡ÐµÑ€ÐµÐ· Firefox Ð¸ Opera

Thu, 20 Sep 2007 17:16:47 +0000

By: Security and Development blog » Puertas traseras en archivos de Windows Media

Thu, 20 Sep 2007 14:24:04 +0000

[...] Backdooring Windows Media Files http://www.gnucitizen.org/blog/backdooring-windows-media-files [...]

By: DigitMemo.com » Firefox Won’t Save You from IE Flaws

DigitMemo.com » Firefox Won’t Save You from IE Flaws — Thu, 20 Sep 2007 09:16:24 +0000

[...] Petko D. Petkov said in a Sept. 18 blog posting that he’s found that a fully patched Windows XP Service Pack 2 system running Internet [...]

By: CrashOne

CrashOne — Thu, 20 Sep 2007 07:13:40 +0000

This example illustrates the lack of good security within MS products.

Althoug i think this wil be patched soon, simply change the default behaviour of WMP.

If your default player for WMP files isn’t WMP (like VLC) your not vulnerable.

By: chucky

chucky — Thu, 20 Sep 2007 03:55:43 +0000

good job man, this is pretty crazy

By: Joe Phantom

Joe Phantom — Wed, 19 Sep 2007 21:29:00 +0000

Another excellent post about meta files danger.

By: Doomwatchers sound Windows and IE vuln alarm | xMoDx

Doomwatchers sound Windows and IE vuln alarm | xMoDx — Wed, 19 Sep 2007 20:47:44 +0000

[...] Petko Petkov, the same researcher who published details about last week’s QuickTime flaw, on Tuesday disclosed a new vulnerability in Windows Media Player that allows attackers to lure visitors to malicious sites using Internet Explorer. It could be aimed at people who have avoided the Microsoft browser for security concerns, Petkov said here. [...]

By: FiSh

FiSh — Wed, 19 Sep 2007 04:03:54 +0000

I’ve been reading your RSS feed for the past week or two, and let me tell you, you’ve scared me shitless! Keep up the good work ;)

By: Rosario Valotta

Rosario Valotta — Tue, 18 Sep 2007 22:47:26 +0000

embedding window. The only limit to this is that you must define in the tag the HTML node (a DIV for example) where the TEXT script shoud be showed.
I’ve tried to embed a wmp in sites that allow video uploading (spaces.live.com, myspace.com) but the embed code always is sanitized so I had no succes in exploiting this functionality.