Technical description:
Windows Media Player provides support for audio and video streaming. Streaming media channels can be configured by using Windows Media Station (.NSC) files. An unchecked buffer exists in the functionality used to process Windows Media Station files. This unchecked buffer could potentially allow an attacker to run code of his choice on the machine of another user. The attacker could either send a specially malformed file to another user and entice her to run or preview it, or he could host such a file on a web site and cause it to launch automatically whenever a user visited the site. The code could take any action on the machine that the legitimate user himself could take.

Mitigating factors:
Customers who have applied the Outlook E-mail Security Update (OESU) for Outlook 2000 or are running Outlook XP, which has the OESU functionality built-in, are automatically protected against HTML e-mail based attempts to exploit this vulnerability.
For others not in the above categories, the attacker would have to entice the potential victim to visit a web site he controlled, or to open an HTML e-mail he had sent.
The attacker would need to know the specific operating system that the user was running in order to tailor the attack code properly; if the attacker made an incorrect guess about the user’s operating system platform, the attack would crash the user’s Windows Media Player session, but not run code of the attacker’s choice.

A patch is available to fix this vulnerability. Please read the Security Bulletin http://www.microsoft.com/technet/security/bulletin/ms01-042.asp for information on obtaining this patch.

You can view all the Security Bulletins on our Microsoft Security Bulletin Summary List