Microsoft DirectX Bug in DirectShow QuickTime Parser Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1022299 |
|
SecurityTracker URL: http://securitytracker.com/id/1022299
|
|
CVE Reference:
CVE-2009-1537
(Links to External Site)
|
Updated: Jul 14 2009
|
Original Entry Date: May 28 2009
|
Impact:
Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 7.0, 8.1, 9.0
|
Description:
A vulnerability was reported in Microsoft DirectX. A remote user can cause arbitrary code to be executed on the target user's system.
A remote user can create a specially crafted QuickTime media file that, when loaded by the target user, will execute arbitrary code on the target system. The code will run with the privileges of the target user.
This code can be exploited via web pages.
Windows Vista and Windows Server 2008 are not affected.
This vulnerability is being actively exploited.
|
Impact:
A remote user can create a media file that, when loaded by the target user, will execute arbitrary code on the target user's system.
|
Solution:
The vendor has issued the following fixes:
Microsoft Windows 2000 Service Pack 4, DirectX 7.0:
http://www.microsoft.com/downloads/details.aspx?familyid=e3e54348-6548-4162-b4c0-9910ec6e18b3
Microsoft Windows 2000 Service Pack 4, DirectX 8.1:
http://www.microsoft.com/downloads/details.aspx?familyid=ce297c3e-8122-4276-a9c2-d1a404f8028d
Microsoft Windows 2000 Service Pack 4, DirectX 9.0:
http://www.microsoft.com/downloads/details.aspx?familyid=862db2ad-3c1f-4a26-af70-d8c4f5a69dda
Windows XP Service Pack 2 and Windows XP Service Pack 3, DirectX 9.0:
http://www.microsoft.com/downloads/details.aspx?familyid=09d585cb-481d-4767-875e-9c6ebe456b80
Windows XP Professional x64 Edition Service Pack 2, DirectX 9.0:
http://www.microsoft.com/downloads/details.aspx?familyid=f8cd4803-82da-467c-8cb1-520f5a6021d4
Windows Server 2003 Service Pack 2, DirectX 9.0:
http://www.microsoft.com/downloads/details.aspx?familyid=571d57c5-1ef8-4dc4-a1e5-2211a805f0cc
Windows Server 2003 x64 Edition Service Pack 2, DirectX 9.0:
http://www.microsoft.com/downloads/details.aspx?familyid=1779cbc0-0c29-4fac-a3a6-8b335ffcb98e
Windows Server 2003 with SP2 for Itanium-based Systems, DirectX 9.0:
http://www.microsoft.com/downloads/details.aspx?familyid=48282a89-f849-405a-a31e-2676f45b5042
A restart may be required.
The Microsoft advisory is available at:
http://www.microsoft.com/technet/security/bulletin/ms09-028.mspx
The vendor's original blog entry is available at:
http://blogs.technet.com/srd/archive/2009/05/28/new-vulnerability-in-quicktime-parsing.aspx
|
Vendor URL: www.microsoft.com/technet/security/advisory/971778.mspx (Links to External Site)
|
Cause:
Access control error
|
Underlying OS:
Windows (2000), Windows (2003), Windows (XP)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Thu, 28 May 2009 19:14:41 -0400
Subject: Vulnerability in Microsoft DirectShow Could Allow Remote Code Execution
|
http://www.microsoft.com/technet/security/advisory/971778.mspx
CVE-2009-1537
|
|
