Microsoft Denies Media Player Flaw

Microsoft is denying reports of a flaw in Windows Media Player that could allow for remote code execution.

Last week researcher Laurent Gaffie wrote on the BugTraq security mailing list, claiming a flaw in Windows Media Player 9, 10, and 11, according to CNET. He said the flaw would allow a hacker to send a malformed file (WAV, Midi, or SND) to compromise PCs running XP or Vista. He even included proof of concept code that he claimed would allow remote code execution.

Now Microsoft has investigated those claims and pronounced them false, and slammed Gaffie on its Security Vulnerability Research & Defense blog for publishing without contacting the company first.

Microsoft says that after Gaffie’s report, “other organizations picked the report up and claimed that the issue was a code-execution vulnerability in Windows Media Player. Those claims are false. We’ve found no possibility for code execution in this issue. Yes, the proof-of-concept code does trigger a crash of Windows Media Player, but the application can be restarted right away and doesn’t affect the rest of the system."

The company claimed the flaw had been detected earlier and corrected in Windows Server 2003 Service Pack 2.