Title

Media Player is configured to allow automatic CODEC downloads. (Cat II impact)

Discussion

The Windows Media Player uses software components, referred to as CODECs, to play back media files. By default, when an unknown file type is opened with the Media Player it will search the Internet for the appropriate CODEC and automatically download it. To ensure platform consistency and to protect against new vulnerabilities associated with media types, all CODECs must be installed by the System Administrator.

Check Content

If the following registry value doesn’t exist or its value is not set to 1, then this is a finding: Registry Hive: HKEY_Current_User Subkey: \Software\Policies\Microsoft\WindowsMediaPlayer\ Value Name: PreventCodecDownload Type: REG_DWORD Value: 1

Fix Text

Configure the policy value for User Configuration -> Administrative Templates -> Windows Components -> Windows Media Player -> Playback “Prevent Codec Download” to “Enabled”.

Additional Identifiers

Rule ID: SV-3481r1_rule

Vulnerability ID: V-3481

Group Title: Media Player - Prevent Codec Download

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.