PT-2009-2784 · Microsoft · Directshow+1

Piotr Bania · Publicado 2009-04-15 · Atualizado 2019-02-26 · CVE-2009-0084

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft DirectX versions 8.1 through 9.0

Description The issue is related to a use-after-free vulnerability in DirectShow, which can be exploited by remote attackers to execute arbitrary code. This can be achieved through an MJPEG file or video stream containing a malformed Huffman table. The vulnerability triggers an exception that frees heap memory, which is later accessed, leading to potential code execution.

Recommendations For Microsoft DirectX versions 8.1 through 9.0, update to a newer version that contains a fix for this issue.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2009-0084

Produtos afetados

Directshow

Directx

Referências · 11

• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5618 · Nota
• http://piotrbania.com/all/adv/ms-directx-mjpeg-adv.txt · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-011 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-0084 · Nota de Segurança
• http://secunia.com/advisories/34665 · Nota
• http://support.avaya.com/elmodocs2/security/ASA-2009-132.htm · Nota
• http://vupen.com/english/advisories/2009/1025 · Nota
• http://osvdb.org/53632 · Nota
• http://securitytracker.com/id?1022040 · Nota
• http://securityfocus.com/bid/34460 · Nota
• http://us-cert.gov/cas/techalerts/TA09-104A.html · Nota