Boletines de Vulnerabilidades

int(4352)

Boletines de Vulnerabilidades

Múltiples vulnerabilidades en Microsoft Windows Media Player
Clasificación de la vulnerabilidad
Propiedad	Valor
Nivel de Confianza	Oficial
Impacto	Obtener acceso
Dificultad	Experto
Requerimientos del atacante	Acceso remoto sin cuenta a un servicio estandar
Información sobre el sistema
Propiedad	Valor
Fabricante afectado	Microsoft
Software afectado	Windows Media Player 6.4 Windows Media Format Runtime 9.0 Windows Media Format Runtime 9.5 Windows Media Format Runtime 11 Windows Media Services 4.1 Windows Media Services 9
Descripción
Se han descubierto múltiples vulnerabilidades en Microsoft Windows Media Player. Las vulnerabilidades son descritas a continuación: - CVE-2008-3009: La vulnerabilidad reside en un error en el manejo del identificador SPN (Service Principal Name) en las respuestas a peticiones de autenticación. Un atacante remoto podría ejecutar código arbitrario mediante métodos de autenticación basados en credenciales NTLM. - CVE-2008-3010: La vulnerabilidad reside en un error que permite fugas de las credenciales NTLM del usuario a URLs que usa direcciones ISATAP. Un atacante remoto podría ejecutar código arbitrario mediante réplicas de peticiones de autenticación.
Solución
Actualización de software Microsoft (MS08-076) Windows Media Player 6.4 / Microsoft Windows 2000 Server Service Pack 4 / patch WindowsMedia64-KB954600-x86-ENU Windows Media Player 6.4 / Windows XP Service Pack 2 y Windows XP Service Pack 3 / patch WindowsXP-KB954600-x86-ENU Windows Media Player 6.4 / Windows XP Professional x64 Edition y Windows XP Professional x64 Edition Service Pack 2 / patch WindowsServer2003.WindowsXP-KB954600-x64-ENU Windows Media Player 6.4 / Windows Server 2003 Service Pack 1 y Windows Server 2003 Service Pack 2 / patch WindowsServer2003-KB954600-x86-ENU Windows Media Player 6.4 / Windows Server 2003 x64 Edition y Windows Server 2003 x64 Edition Service Pack 2 / patch WindowsServer2003.WindowsXP-KB954600-x64-ENU Windows Media Format Runtime 7.1 y Windows Media Format Runtime 9.0 / Microsoft Windows 2000 Service Pack 4 / Windows2000-WindowsMedia-KB952069-x86-ENU Windows Media Format Runtime 9.0, Windows Media Format Runtime 9.5, y Windows Media Format Runtime 11 / Windows XP Service Pack 2 / patch WindowsXP-SP2-WindowsMedia-KB952069-x86-ENU Windows Media Format Runtime 9.0, Windows Media Format Runtime 9.5, y Windows Media Format Runtime 11 / Windows XP Service Pack 3 / patch WindowsXP-WindowsMedia-KB952069-x86-ENU Windows Media Format Runtime 9.5 / Windows XP Professional x64 Edition y Windows XP Professional x64 Edition Service Pack 2 / patch WindowsServer2003.WindowsXP-KB952069-x64-ENU Windows Media Format Runtime 9.5 x64 Edition / Windows XP Professional x64 Edition y Windows XP Professional x64 Edition Service Pack 2 / patch WindowsMedia10-KB952069-x64-ENU Windows Media Format Runtime 11 / Windows XP Professional x64 Edition y Windows XP Professional x64 Edition Service Pack 2 / patch WindowsMedia11-KB952069-x64-ENU Windows Media Format Runtime 9.5 / Windows Server 2003 Service Pack 1 y Windows Server 2003 Service Pack 2 / patch WindowsServer2003-KB952069-x86-ENU Windows Media Format Runtime 9.5 / Windows Server 2003 x64 Edition y Windows Server 2003 x64 Edition Service Pack 2 / WindowsServer2003.WindowsXP-KB952069-x64-ENU Windows Media Format Runtime 11 / Windows Vista y Windows Vista Service Pack 1 / patch Windows6.0-KB952069-x86 Windows Media Format Runtime 11 / Windows Vista x64 Edition y Windows Vista x64 Edition Service Pack 1 / patch Windows6.0-KB952069-x64 Windows Media Format Runtime 11 / Windows Server 2008 for 32-bit Systems / patch Windows6.0-KB952069-x86 Windows Media Format Runtime 11 / Windows Server 2008 for x64-based Systems / patch Windows6.0-KB952069-x64 Windows Media Services 4.1 / Microsoft Windows 2000 Server Service Pack 4 / patch WindowsMedia41-KB952068-x86-ENU Windows Media Services 9 Series / Windows Server 2003 Service Pack 1 y Windows Server 2003 Service Pack 2 / patch WindowsServer2003-KB952068-x86-ENU Windows Media Services 9 Series / Windows Server 2003 x64 Edition y Windows Server 2003 x64 Edition Service Pack 2 / patch WindowsServer2003.WindowsXP-KB952068-x64-ENU Windows Media Services 2008 / Windows Server 2008 for 32-bit Systems / patch Windows6.0-KB952068-x86 Windows Media Services 2008 / Windows Server 2008 for x64-based Systems / patch Windows6.0-KB952068-x64 Hewlett-Packard (HPSBST02394) Storage Management Appliance v2.1 Instale el parche de Microsoft correspondiente a su sistema operativo.
Identificadores estándar
Propiedad	Valor
CVE	CVE-2008-3009 CVE-2008-3010
BID
Recursos adicionales
Microsoft Security Bulletin (MS08-076) http://www.microsoft.com/technet/security/bulletin/ms08-076.mspx HP SECURITY BULLETIN (HPSBST02394) http://www11.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c01632189-1