-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
             AUSCERT External Security Bulletin Redistribution

           ESB-2001.069 -- Microsoft Security Bulletin MS01-010
      Patch Available for "Windows Media Player Skins File Download"
                              Vulnerability
                             19 February 2001

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:                Windows Media Player 7
Vendor:                 Microsoft
Impact:                 Execute Arbitrary Code/Commands
Access Required:        Remote

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----

- - ----------------------------------------------------------------------
Title:      Patch Available for
            "Windows Media Player Skins File Download" Vulnerability
Date:       February 14, 2001
Software:   Windows Media Player 7
Impact:     Run arbitrary code
Bulletin:   MS01-010

Microsoft encourages customers to review the Security Bulletin at:
http://www.microsoft.com/technet/security/bulletin/MS01-010.asp.
- - ----------------------------------------------------------------------

Issue:
======
Windows Media Player 7 introduced a feature called "skins", that
allows customization of the look and feel of Windows Media Player. If
a Windows Media Player skin (.WMZ) file were downloaded from a
malicious web site it could potentially be used to run Java code to
read and browse files on a local machine. The vulnerability stems
from the fact that "skins" are downloaded to a known location on a
victim's computer and are stored in a .zip package. If the .zip
package contained a Java class (.class) file, any Java code in this
class could be executed under the local computer security zone.

If a Windows Media Player skin (.WMZ) file were downloaded from a
malicious web site, it could potentially cause the deployment of
zipped Java code to a known location on the visiting user's machine.
Since the Java code would reside in a known location on the machine,
script hosted on a hostile web site or embedded in a hostile HTML
mail message could potentially invoke the script in the local
computer security zone to take arbitrary action on the user's
machine.

Mitigating Factors:
====================
 - Disable the running of unsigned Java content
 - Be wary of visiting malicious web sites or opening e-mail from
   unknown sources

Patch Availability:
===================
 - A patch is available to fix this vulnerability. Please read the
   Security Bulletin
   http://www.microsoft.com/technet/security/bulletin/ms01-010.asp
   for information on obtaining this patch.

- - ---------------------------------------------------------------------

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED
"AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL
WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT
SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY
DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO
THE FOREGOING LIMITATION MAY NOT APPLY.

- -----BEGIN PGP SIGNATURE-----
Version: PGP Personal Privacy 6.5.3

iQEVAwUBOorNCo0ZSRQxA/UrAQGW2gf/WO7Jp9PXvCspTxQ+ZKgJtWALi1mnDz/z
IfyrxZ6vIGdkgdRKCVPPHx+w27hzPvIU1B9Pm+UkcjQlj3QOWGTQjJhL3ANW1oFU
3pwGcJbv1LoibFB7Z99E+JRPWXi1JGupE2/06jCLBF/2KC9+kmu762tCfmuurlrk
44QUdnUyWxC3iIl8qEHvNZYK8qKLcKvyrn9bz5KFMcp4u9dX2SsneuSzi8FZbzxG
H2CUYOF95ETKd0zdc6qr0ZIUuPMyDeF4Yjnwlx6xz0DAeFJwwhoIM4I9kV7CYZxi
ODGRZFYc0QJlLtlPOsBAyngCSWseHQ7mJSTyKYEcmRev0IeMfGqOvw==
=eeF9
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content.  The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the original authors to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

	http://www.auscert.org.au/Information/advisories.html

If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).

Internet Email: auscert@auscert.org.au
Facsimile:	(07) 3365 7031
Telephone:	(07) 3365 4417 (International: +61 7 3365 4417)
		AusCERT personnel answer during Queensland business hours
		which are GMT+10:00 (AEST).
		On call after hours for emergencies.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key

iQCVAwUBOpDxDSh9+71yA2DNAQEV2QP/YKwpLerVK290JR6sjHwZApVF74iANLar
USeRbaPikvlWjV7ezPgcnp9Q7Xa7h2Zb8faG114dNh/LUsZqQNuhCivvBN/5ALs5
fa/f4zq+9L7KxfeUCKXYaae1QFztojUoPINYye+AycAbxSQenfR2+wHAJgPwx0rT
Yd+3iXv0QGg=
=T9Y/
-----END PGP SIGNATURE-----