PT-2009-4905 · Microsoft · Windows Media Services+1

Peter Winter-Smith · Publicado 2009-09-08 · Atualizado 2023-12-07 · CVE-2009-2498

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows Media Format Runtime versions 9.0, 9.5, and 11 Windows Media Services versions 9.1 and 2008

Description The issue arises from the improper parsing of malformed headers in Advanced Systems Format (ASF) files, which can lead to the execution of arbitrary code. This can be achieved by a remote attacker through a crafted file with extensions such as .asf, .wmv, or .wma.

Recommendations For Microsoft Windows Media Format Runtime versions 9.0, 9.5, and 11, update to a version that properly handles ASF file headers to prevent arbitrary code execution. For Windows Media Services versions 9.1 and 2008, apply the necessary patches or updates to ensure correct parsing of ASF file headers and prevent exploitation.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2009-2498

Produtos afetados

Windows Media Format Runtime

Windows Media Services

Referências · 4

• http://us-cert.gov/cas/techalerts/TA09-251A.html · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6257 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-2498 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-047 · Aviso do Fabricante