The Channel logo


By | John Leyden 30th December 2008 10:41

Windows Media Player flaw denied

Security pantomime

Researchers reckon a security bug in Windows Media Player creates a means for hackers to inject hostile code onto vulnerable systems. However Microsoft has denied this, saying that the bug only creates a means to crash the software without posing a more damaging security risk.

The WMP integer overflow bug reportedly kicks in when the media player attempts to process maliciously constructed WAV, SND, or MIDI files. Security researchers have created proof of concept code demonstrating the vulnerability, the SANS Institute's Internet Storm Centre reports.

Fully patched Windows XP systems running either Windows Media Player 9 and 11 are each potentially vulnerable, according to tests by SecurityTracker. Other configurations may also be affected.

In a posting on Microsoft's Security Response blog, Redmond's security gnomes downplay the seriousness of the flaw, criticising researchers for spooking the internet community with what Microsoft charecterises as a premature disclosure. ®

comment icon Read 6 comments on this article alert Send corrections


Frank Jennings

What do you do? Use manual typwriters or live in a Scottish croft? Our man advises
A rusty petrol pump at an abandoned gas station. Pic by Silvia B. Jakiello via shutterstock

Trevor Pott

Among other things, Active Directory needs an overhaul
Baby looks taken aback/shocked/affronted. Photo by Shutterstock

Kat Hall

Plans for 2 million FTTP connections in next four years 'not enough'
Microsoft CEO Satya Nadella


League of gentlemen poster - Tubbs and Edward at the local shop. Copyright BBC
One reselling man tells his tale of woe