PT-2009-1181 · Microsoft · Windows+1
Alex Wheeler
+1
·
Publicado
2009-07-07
·
Atualizado
2026-02-20
·
CVE-2008-0015
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Microsoft Windows versions 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2
Description
A stack-based buffer overflow exists in the
CComVariant::ReadFromStream function within the Active Template Library (ATL), specifically as used by the MPEG2TuneRequest ActiveX control in msvidctl.dll within Microsoft DirectShow. This allows remote attackers to execute arbitrary code through a crafted web page. The issue was exploited in the wild in July 2009. Successful exploitation grants the attacker the same user rights as the logged-on user. The vulnerable component is the Microsoft Video ActiveX Control.Recommendations
Versions prior to Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 are affected.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
RCE
Buffer Overflow
Stack Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Video Activex Control
Windows