Microsoft Security Advisory (892313)

Purpose of Advisory: Notification of the availability of the update to help protect against this potential threat.

Advisory Status: Knowledge Base Article and associated update were released.

Recommendation: Review the referenced Knowledge Base Article and apply the appropriate update for increased security.

What versions of Windows Media Player are associated with this advisory?
This advisory pertains to Windows Media Player 9 and Windows Media Player 10.

Is this a security vulnerability that requires Microsoft to issue an update?
Although this is not a security vulnerability, this update was issued to provide additional warning for users who could be deceived into visiting a malicious Web site.

What is the scope of the advisory?
The scope of this advisory is to inform Windows Media Player users that an update has been released to reduce the risk of users being deceived into visiting a Web site.

What causes this threat?
An attacker could create a social engineering attack that abuses a function of the Windows Media DRM system designed to allow common license delivery scenarios. It does not automatically cause malicious software to run on the user’s computer.

What might an attacker use this function to do?
An attacker can create media files that could use this function to trick users into visiting a malicious Web site. This Web site could then try and trick the user into downloading and executing malicious software add-ons, such as spyware.

What does this feature do?
This feature let users specify whether they want to have Windows Media Player automatically acquire licenses to play protected content, or whether they would prefer to be prompted when a license is required.

Users should make sure their Windows Media Player software is current with the latest updates, which were released in March, 2005.

• Update Windows Media Player

  Windows Media Player users can install the update from Microsoft Knowledge Base Article 892313.

• Keep Windows Updated

  All Windows users should apply the latest Microsoft security updates to help make sure that their computers are as protected as possible. If you are not sure whether your software is up to date, visit the Microsoft Update Web site, scan your computer for available updates, and install any high-priority updates that are offered to you. If you have Automatic Updates enabled, the updates are delivered to you when they are released, but you have to make sure you install them.