Last week on December 24, security researcher Laurent Gaffi reported what he called a critical security flaw in Microsoft's Windows Media Player to the Bugtraq security mailing list, marking the second major Windows vulnerability found in recent weeks.  He said the flaw, which affects Versions 9, 10, and 11 could allow malicious users to malformed .wav, .snd, or .mid audio files to compromise a PC running Windows XP or Windows Vista.

Mr. Gaffi included code for a proof-of-concept attack, which would execute code remotely on the victim's PC. 

The claims evoked a quick and emphatic response from Microsoft.  Microsoft claims that there is no "critical vulnerability" at all, and that the bug the research found could not be exploited.  Microsoft stated that the problem is a "reliability issue with no security risk to customers."

The company also took Mr. Gaffi to task for publishing his findings without first reporting them to security researchers.

Christopher Budd, a spokesman for the Microsoft Security Response Center (MSRC) said in an MSRC blog, "[Gaffi's] claims are false.  We've found no possibility for code execution in this issue."

He did acknowledge that the flaw crashes Windows Media Player, but he claimed that it could be restarted without restarting the operating system and with no negative side effects.  Microsoft's Security Vulnerability Research and Defense (SVRD) group released its own researchers' technical take on the bug.

Jonathan Ness and Fermin Serna of the SVRD team knew of the bug and had fixed it in one server version of the media player.  They too argued it could not be used to cause serious damage, stating, "This bug cannot be leveraged for arbitrary code execution.  We found this already through our internal fuzzing efforts.  It was correctly triaged at the time as a reliability issue with no security risk to customers."

Mr. Ness and Serna concluded, "We do like to get these reliability issues fixed in a future service pack or a future version of the platform whenever possible. This particular bug, for example, has already been fixed in Windows Server 2003 Service Pack 2."

Some are skeptical, though, of Microsoft's claims.  Last April researchers discovered an operating system-level vulnerability, which Microsoft promptly denied was dangerous.  Three weeks later it was forced to recant and issue a security advisory.  Despite being actively exploited since October Microsoft has yet to issue a fix for that problem.  Of late Microsoft has been under increasing and contradictory pressure to release patches more quickly and test them more thoroughly.