Security researchers are warning that popular media players offered by Microsoft and AOL are vulnerable to attacks that can completely compromise a user's PC.

Attack code has already been released for the bug, which has been confirmed in a codec used by older versions of Windows Media Player, made by Microsoft, and in AOL's Winamp. A Symantec researcher has warned that users of other players may also be at risk because the vulnerability itself resides in a commonly used MP4 codec produced by a company called 3ivx Technologies.

"The exploit works by supplying victims with a maliciously formed MP4 file," Raymond Ball wrote for Symantec's DeepSight Threat Management System. "When a victim unknowingly clicks a link that appears safe, the MP4 content is delivered, causing the exploit to run."

A researcher who goes by the name SYS 49152 released exploit code here, here and here that targets Windows Media Player 6.4 and Windows Media Player Classic, which are made by Microsoft, and AOL's Winamp version 3.5. Each uses the 3ivx MP4 codec, which is vulnerable to a stack overflow.

Secunia describes the Windows Media Player vulnerabilities as "highly critical," the second-highest rating on Secunia's five-tier scale. The vulnerability reporting service didn't have a rating for the Winamp vulnerability.

No patch is available. Ball recommends users remove the codec or disable media players that use the MP4 codec until the hole is plugged. That strikes us as overkill. Taking care not to click on suspicious links in browsers and email programs should suffice.

The vulnerabilities are the latest reminders of the exposure that can come from using a media player. Two weeks ago, a security bug was discovered in the way Apple's QuickTime that leaves PC and Mac users alike at risk of remote hijacking. Apple has yet to acknowledge the vulnerability, which resides in the way QuickTime interacts with servers that stream audio and video. ®

More comments…

Related stories

Microsoft dishes out six critical updates (13 February 2008)
AOL scoops up online marketing network (6 February 2008)
Winamp blighted by bug brace (21 January 2008)
Microsoft plugs 'critical' hole in Vista (8 January 2008)
Hey, HP laptop owners: click here to get hijacked (12 December 2007)
Latest QuickTime Exploit targets both Macs and PCs (29 November 2007)
Daft users and insecure web apps dominate threat index (27 November 2007)
QuickTime streaming media exploit targets unpatched bug (26 November 2007)
Alicia Keys hit by MySpace Trojan hack (9 November 2007)
QuickTime update fixes code-execution holes (6 November 2007)
Real Media attacks real people via RealPlayer (23 October 2007)
Apple patches Windows QuickTime bug (4 October 2007)
Security maven: QuickTime flaw threatens PCs, Macs (12 September 2007)