Microsoft Windows Media File Format Stream Property error correction and type-specific buffer overflow
| win-mediaplayer-stream-property-bo (38829) |  High Risk |
Description:
Microsoft Windows Media File Format is vulnerable to a heap-based buffer overflow, caused by improper bounds checking of the error correction and type-specific data lengths of a Stream Property entry in an ASF stream. By persuading a victim to open a specially-crafted ASF file, a remote attacker could overflow a buffer and execute arbitrary code on the victim's system. An attacker could exploit this vulnerability by sending the malicious file as an email attachment or hosting it on a Web site.
Platforms Affected:
- Microsoft, Windows 2000 SP4
- Microsoft, Windows 2003 Server x64
- Microsoft, Windows 2003 Server SP2 x64
- Microsoft, Windows 2003 Server SP2
- Microsoft, Windows Media Format Runtime 11
- Microsoft, Windows Media Format Runtime 7.1
- Microsoft, Windows Media Format Runtime 9
- Microsoft, Windows Media Format Runtime 9.5 x64
- Microsoft, Windows Media Format Runtime 9.5
- Microsoft, Windows Media Services 9.1
- Microsoft, Windows Vista
- Microsoft, Windows Vista x64
- Microsoft, Windows XP SP2
- Microsoft, Windows XP Professional x64
- Microsoft, Windows XP SP2 Professional x64
Remedy:
Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS07-068. See References.
Consequences:
Gain Access
References:
- IBM Internet Security Systems Protection Advisory Dec. 11, 2007, Multiple (4) Microsoft Windows Media Player .ASF Remote Code Execution Vulnerabilities at http://www.iss.net/threats/279.html.
- IBM Internet Security Systems X-Force Database, Microsoft Windows Media File Format ASF multiple buffer overflows at http://xforce.iss.net/xforce/xfdb/33225.
- Microsoft Security Bulletin MS07-068, Vulnerability in Windows Media File Format Could Allow Remote Code Execution (941569 and 944275) at http://www.microsoft.com/technet/security/Bulletin/MS07-068.mspx.
- ASA-2007-512: MS07-068 Vulnerability in Windows Media File Format Could Allow Remote Code Execution (941569 and 944275)
- BID-26776: Microsoft Windows Media Format Runtime ASF File Remote Code Execution Vulnerability
- CVE-2007-0064: Heap-based buffer overflow in Windows Media Format Runtime 7.1, 9, 9.5, 9.5 x64 Edition, 11, and Windows Media Services 9.1 for Microsoft Windows 2000, XP, Server 2003, and Vista allows user-assisted remote attackers to execute arbitrary code via a crafted Advanced Systems Format (ASF) file.
- FrSIRT/ADV-2007-4183: Microsoft Windows ASF Media Format Remote Code Execution (MS07-068)
- SA28034: Windows Media Format Runtime ASF Parsing Vulnerabilities
- SECTRACK ID: 1019074: Windows Media Format Runtime ASF File Parsing Bug Lets Remote Users Execute Arbitrary Code
- US-CERT VU#319385: Microsoft Windows Media Format Runtime ASF handling buffer overflow
Reported:
Dec 11, 2007
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net