PT-2009-4906 · Microsoft · Server 2008+3

Hiroshi Noguchi · Publicado 2009-09-08 · Atualizado 2023-12-07 · CVE-2009-2499

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows Media Format Runtime versions 9.0 through 11 Microsoft Media Foundation on Windows Vista and Server 2008 versions prior to SP2

Description The issue allows remote attackers to execute arbitrary code via an MP3 file with crafted metadata that triggers memory corruption.

Recommendations For Microsoft Windows Media Format Runtime versions 9.0 through 11, update to a version that is not affected by this issue. For Microsoft Media Foundation on Windows Vista and Server 2008 versions prior to SP2, apply the necessary patches or updates to resolve the issue.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2009-2499

Produtos afetados

Media Foundation

Server 2008

Windows Media Format Runtime

Windows Vista

Referências · 4

• http://us-cert.gov/cas/techalerts/TA09-251A.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-2499 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-047 · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5531 · Nota