Windows Media Format Runtime ASF File Parsing Bug Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1019074
|
|
SecurityTracker URL: http://securitytracker.com/id?1019074
|
|
CVE Reference: CVE-2007-0064
(Links to External Site)
|
Date: Dec 11 2007
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Microsoft Security Bulletin
|
Version(s): 2000 SP4, 2003 SP2, XP SP2, Vista; and prior service packs
|
Description: A vulnerability was reported in Microsoft Windows Media Format Runtime. A remote user can cause arbitrary code to be executed on the target user's system.
A remote user can create a specially crafted Advanced Systems Format (ASF) file that, when loaded by the target user, will execute
arbitrary code on the target system. The code will run with the privileges of the target user.
Ryan Smith of IBM Internet Security
Systems X-Force reported this vulnerability.
|
Impact: A remote user can create a file that, when loaded by the target user, will execute arbitrary code on the target user's system.
|
Solution: Microsoft has issued fixes for:
Windows Media Format Runtime 7.1
Windows Media Format Runtime 9
Windows Media Format Runtime
9.5
Windows Media Format Runtime 9.5 x64 Edition
Windows Media Format Runtime 11
Windows Media Services 9.1
A restart is not
required.
The download URLs are available in the Microsoft advisory.
The Microsoft advisory is available at:
http://www.microsoft.com/technet/security/bulletin/m
s07-068.mspx
|
Vendor URL: www.microsoft.com/technet/security/bulletin/ms07-068.mspx (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Windows (2000), Windows (2003), Windows (Vista), Windows (XP)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 11 Dec 2007 13:37:32 -0500
Subject: Microsoft Security Bulletin MS07-068 - Critical: Vulnerability in Windows Media File Format Could Allow Remote Code Execution (941569 and 944275)
|
http://www.microsoft.com/technet/security/bulletin/ms07-068.mspx
CVE-2007-0064
|
|
