CVE-2006-4702

Buffer overflow in the Windows Media Format Runtime in Microsoft Windows Media Player (WMP) 6.4 and Windows XP SP2, Server 2003, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted Advanced Systems Format (ASF) file.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://securitytracker.com/id?1017372
http://support.avaya.com/elmodocs2/security/ASA-2006-274.htm
http://www.securityfocus.com/bid/21505
http://www.us-cert.gov/cas/techalerts/TA06-346A.html	US Government Resource
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A536
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-078
http://www.securityfocus.com/archive/1/454969/100/200/threaded

Configurations

Configuration 1 (hide)

cpe:2.3:a:microsoft:windows_media_player:6.4:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:o:microsoft:windows_2003_server:gold:::::::*
	cpe:2.3:o:microsoft:windows_2003_server:sp1:::::::*
	cpe:2.3:o:microsoft:windows_xp::sp2:tablet_pc:::::

Information

Published : 2006-12-12 17:28

Updated : 2018-10-17 14:39

NVD link : CVE-2006-4702

Mitre link : CVE-2006-4702

JSON object : View

CWE

NVD-CWE-Other

Products Affected

microsoft

windows_xp
windows_2003_server
windows_media_player

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://securitytracker.com/id?1017372", "name": "1017372", "tags": [], "refsource": "SECTRACK"}, {"url": "http://support.avaya.com/elmodocs2/security/ASA-2006-274.htm", "name": "http://support.avaya.com/elmodocs2/security/ASA-2006-274.htm", "tags": [], "refsource": "CONFIRM"}, {"url": "http://www.securityfocus.com/bid/21505", "name": "21505", "tags": [], "refsource": "BID"}, {"url": "http://www.us-cert.gov/cas/techalerts/TA06-346A.html", "name": "TA06-346A", "tags": ["US Government Resource"], "refsource": "CERT"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A536", "name": "oval:org.mitre.oval:def:536", "tags": [], "refsource": "OVAL"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-078", "name": "MS06-078", "tags": [], "refsource": "MS"}, {"url": "http://www.securityfocus.com/archive/1/454969/100/200/threaded", "name": "SSRT061288", "tags": [], "refsource": "HP"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Buffer overflow in the Windows Media Format Runtime in Microsoft Windows Media Player (WMP) 6.4 and Windows XP SP2, Server 2003, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted Advanced Systems Format (ASF) file."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2006-4702", "ASSIGNER": "secure@microsoft.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": true, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2006-12-13T01:28Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:microsoft:windows_media_player:6.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:microsoft:windows_2003_server:gold:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_2003_server:sp1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_xp:*:sp2:tablet_pc:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-17T21:39Z"}

6.8 /10