AfterDawn: Tech news

Bug in Windows Media Player allows hijacking computers

Written by Petteri Pyyny @ 07 May 2003 3:44 User comments (14)

Microsoft announced today that there's a critical security hole in its Windows Media Player products. The bug would allow attackers to "hijack" user's computer. Bug is available in WMP 7.1 and WMP 8.0, also known as Windows Media Player for XP.
The problem doesn't exist in WMP9 or in the older WMP versions, such as the good olde WMP 6.4 that is almost legendary among the videophiles. The malicious code can be masquerated to look like a WMP7/8 skin and when downloaded and installed, it executes itself and can do virtually anything the code's programmer wants it to do on user's computer.

Microsoft has released a patch for the problem. The bug was found by a Finnish security firm, Online Solutions, in March and it submitted its findings to Microsoft on 14th of March.

More information:

InternetNews.com
Microsoft security bulletin and patch

Previous Next  

14 user comments

18.5.2003 01:26

Good Show from the Finns!!!!! :) I'm glad M$ was honest enough to admit the foul-up rather than just try to hurredly release a new 'cover up' version of WMP. Perhaps the problem is more severe than we realize, and M$ had no choice. Only either pure desperation, or insatiable curiosity (as in the recent HMV download offer), will I advance past WMP 6.4. It's a staple, uninhibited, uncrippled viewer. -- Me --

28.5.2003 06:26

I donīt really like WMP versions 7 and up anyway. 6.4 seems to still be one of the best players around, although I guess Iīll have to try out The DivX player, since it will be utilizing hardware features on my graphics card.

310.5.2003 11:36
Warpoet
Inactive

Thank god i don't use Windows Media player.

410.5.2003 11:52

WMP version 6.4 is A-ok as a simple, utility audio/video player. Anything later than that spells trouble. I wouldn't install anything past Direct-X version 8.0 either. Ver 9.0 cannot be removed (uninstalled) without a very special, hard-to-find utility program.

511.5.2003 09:22

Well itīs not that hard to find. If you ask around on discussion forums that cover things like graphics cards, someone usually has a link.

611.5.2003 12:01

(Perhaps). Point is, Ghostdog, I don't believe that a person should have to rely on hurredly-developed third-part fix-ups (thank god we have them) to counteract MicroSoft's ever-intrusive and insistent way of doing things. Be very very leery of any microsoft software that can't be UNinstalled, once INstalled.

711.5.2003 13:49

I agree, there should be an option to uninstall DirectX. Iīm sure many people would appreciate an option like that.

84.2.2004 14:04
shawn3905
Inactive

Please forgive me if I ask this in the wrong place but I was wondering if Ghostdog knows where I could get a link to get windows media player removed from my computer. Anytime I try to use any other media player, WMP starts and crashes. thanks in advance

94.2.2004 17:37

You should stay away from Media9 player. This one (and those that are sure to follow) contain a phone home tattle tale for those playing mp3's that are not ligitmate files. It is one of the reasons they want to make it hard to remove. Personally, I prefer QCD player and have Media player removed from my computer. I don't like wma files nor do I wish to support the Micro$uck$ platform more than necessary. They can keep DMCA supported files I will keep what I have and we will both have to live with that. There is not much that Micro$uck$ puts out that is not eyed with a fine tooth comb by hackers for any advantage they can find to gain access to your computer.

105.2.2004 04:03

Shawn: I was forced to install WMP9 a while ago to view a presentation, but I didnīt have any major problems when un-installing it. Are you using XP?

115.2.2004 05:39
shawn3905
Inactive

Yes, I have XP home edition

125.2.2004 08:19

I remember hearing awhile ago that WMP is a part of Windows XP itself. Maybe you canīt un-install it at all? Iīm a Windows 2000 user myself, so I canīt really check, but if you ask around someone should be able to tell you if you can un-install it. Try looking for the uninstaller in WMPīs folder. Could you clarify a bit what you mean when you say "anytime I try to use any other media player, WMP starts and crashes"?

136.2.2004 05:03
shawn3905
Inactive

Ya, if I try to use any media player besides WMP (ie. Nero, video lan, roxio) then WMP starts at the same time causing my computer to shut down and reboot, forcing me to use WMP exclusivly. Any ideas are much apprieciated as I would like to use a program other than WMP. (BTW it is version 9) thanx for your help thus far.

146.2.2004 07:09

You could try to change to file associations, if you havenīt gone down that road yet. Access any folder, open "Folder options" from the Tools-menu, go to "File types" and look for specific media files that are set to be played back by WMP and click "Change". Then just select a program from the list that pops up. This is the way it works on Windows 2000. XP should act similarly. Let me know if it works.

Comments have been disabled for this article.

Latest news

VLC hits milestone: over 5 billion downloads VLC hits milestone: over 5 billion downloads (16 Mar 2024 4:31)
VLC Media Player, the versatile video-software powerhouse, has achieved a remarkable feat: it has been downloaded over 5 billion times.
1 user comment
Sideloading apps to Android gets easier, as Google settles its lawsuit Sideloading apps to Android gets easier, as Google settles its lawsuit (19 Dec 2023 11:09)
Google settled its lawsuit in September 2023, and one of the settlement terms was that the way applications are installed on Android from outside the Google Play Store must become simpler. In the future, installing APK files will be easier.
7 user comments
Roomba Combo j7+ review - Clever trick allows robot vacuum finally to tackle home with rugs and carpets Roomba Combo j7+ review - Clever trick allows robot vacuum finally to tackle home with rugs and carpets (06 Jun 2023 9:19)
Roomba Combo j7+ is the very first Roomba model to combine robot vacuum with mopping features. And Roomba Combo j7+ does all that with a very clever trick, which tackles the problem with mopping and carpets. But is it any good? We found out.
Neato, the robot vacuum company, ends its operations Neato, the robot vacuum company, ends its operations (02 May 2023 3:38)
Neato Robotics has ceased its operations. American robot vacuum pioneer founded in 2005 has finally called it quits and company will cease its operations and sales. Only a skeleton crew will remain who will keep the servers running until 2028.
5 user comments
How to Send Messages to Yourself on WhatsApp How to Send Messages to Yourself on WhatsApp (20 Mar 2023 1:25)
The world's most popular messaging platform, Meta-owned WhatsApp has enabled sending messages to yourself. While at first, this might seem like an odd feature, it can be very useful in a lot of situations. ....
18 user comments

News archive