New Flaw Found in Windows Media Player

There is a new vulnerability in the ubiquitous Windows Media Player that could enable an attacker to execute code on the machine of a user who downloads a skin for the player.

When users download new skins - or user interfaces - for the Windows Media Player, the files are automatically saved to the player's "Skins" file folder. As protection against some attacks, WMP introduces a random element into the name of the file so that attackers can't guess the exact name of downloaded skins. However, it's possible to get around this measure by inserting a specific character into the URL of the skin.

More at eWeek