Virus warning hits Windows Media Player

Users urged to be careful when viewing PNG images

Robert Jaques, vnunet.com 11 Feb 2005

Computer users have been warned to be on their guard when viewing images after the discovery of a vulnerability affecting the processing of PNG (Portable Network Graphic) files by popular applications including MSN Messenger and Windows Media Player.

The issue affects applications including Windows Media Player 9.0 (when running on Windows 2000, XP Service Pack 1 and Server 2003), Windows Messenger version 5.0 (standalone version that can be installed on all supported operating systems), and MSN Messenger 6.1 and 6.2.

The PNG format is used by these applications to view icons or any other kind of image. The flaw centres on an error in the processing of these types of files, and could allow arbitrary code to be run on vulnerable systems. A similar problem was discovered with Jpeg files in September last year.

Considering the widespread use of the affected applications, IT security firm Panda Software warned that it is "highly likely" that viruses will emerge to exploit the problem.

Luis Corrons, director of PandaLabs, said: "Every time a security problem is detected in a popular program, the creators of malicious code start trying to find an exploit as quickly as possible.

"Judging by past experience, it is clear that the time gap between the discovery of a vulnerability and the emergence of a virus that takes advantage of it is shortening. For this reason it is important to stay up-to-date on the latest releases for the programs you have on your computer."

Panda urged PC users to download the Microsoft patch that resolves this problem, which can be found here.

Microsoft released a dozen patches on 8 February to fix a range of vulnerabilities, some of which were rated 'critical'.

See also: