Windows Movie Maker Buffer Overflow Lets Remote Users Cause Arbitrary Code to Be Executed
|
|
SecurityTracker Alert ID: 1023697 |
|
SecurityTracker URL: http://securitytracker.com/id?1023697
|
|
CVE Reference:
CVE-2010-0265
(Links to External Site)
|
Updated: May 3 2010
|
Original Entry Date: Mar 9 2010
|
Impact:
Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 2.1, 2.6, 6.0
|
Description:
A vulnerability was reported in Windows Movie Maker. A remote user can cause arbitrary code to be executed on the target user's system.
A remote user can create a specially crafted Movie Maker project file that, when loaded by the target user, will trigger a buffer overflow and execute arbitrary code on the target system. The code will run with the privileges of the target user.
Microsoft Producer 2003 is also affected.
Windows Live Movie is not affected.
Damian Frizza of Core Security Technologies reported this vulnerability.
|
Impact:
A remote user can create a file that, when loaded by the target user, will execute arbitrary code on the target user's system.
|
Solution:
The vendor has issued the following fixes:
Windows XP Service Pack 2 and Windows XP Service Pack 3, Movie Maker 2.1:
http://www.microsoft.com/downloads/details.aspx?familyid=6301E462-02BE-4B9A-BAE9-7C4821B42D2D
Windows XP Professional x64 Edition Service Pack 2, Movie Maker 2.1:
http://www.microsoft.com/downloads/details.aspx?familyid=CAE81585-D0DF-41B8-9277-CA02F1265056
Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2, Movie Maker 6.0:
http://www.microsoft.com/downloads/details.aspx?familyid=AE2E9B75-1616-4FE3-91BB-E2E28252FF1C
Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2, Movie Maker 6.0:
http://www.microsoft.com/downloads/details.aspx?familyid=E27F353E-DEB6-4D61-8808-C751D20A42A1
Windows 7 for 32-bit Systems, Movie Maker 2.6:
http://www.microsoft.com/downloads/details.aspx?familyid=822254EB-2EA6-47A5-B5F8-45EF8EE53447
Windows 7 for x64-based Systems, Movie Maker 2.6:
http://www.microsoft.com/downloads/details.aspx?familyid=0FBF3063-1C2D-408C-A7B5-0C5857593C6F
A restart may be required.
On May 3, 2010, Microsoft revised their bulletin to indicate that users of Microsoft Producer 2003 upgrade to the latest version (Microsoft Producer):
http://www.microsoft.com/downloads/details.aspx?familyid=1b3c76d5-fc75-4f99-94bc-784919468e73
The vendor's advisory is available at:
http://www.microsoft.com/technet/security/bulletin/ms10-016.mspx
|
Vendor URL: www.microsoft.com/technet/security/bulletin/ms10-016.mspx (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS:
Windows (7), Windows (Vista), Windows (XP)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 09 Mar 2010 18:24:17 +0000
Subject: http://www.microsoft.com/technet/security/bulletin/ms10-016.mspx
|
Microsoft Security Bulletin MS10-016 - Important: Vulnerability in Windows Movie Maker Could Allow Remote Code Execution (975561)
CVE-2010-0265
|
|
