PT-2009-6434 · Microsoft+1 · Windows 2000+4

Publicado 2009-12-13 · Atualizado 2018-10-10 · CVE-2009-4310

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows Media Player versions in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2

Description The issue is a stack-based buffer overflow in the Intel Indeo41 codec, which allows remote attackers to execute arbitrary code via crafted compressed video data in an IV41 stream in a media file. This can lead to many loop iterations, as demonstrated by data in an AVI file.

Recommendations For Windows Media Player in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2, consider disabling the Intel Indeo41 codec until a patch is available to prevent exploitation.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2009-4310

Produtos afetados

Intel Indeo41 Codec

Windows 2000

Windows Server 2003

Windows Xp

Windows Media Player

Referências · 15

• http://vupen.com/english/advisories/2009/3440 · Aviso do Fabricante
• http://support.microsoft.com/kb/955759 · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11596 · Nota
• http://secunia.com/advisories/37592 · Aviso do Fabricante
• http://securitytracker.com/id?1023302 · Correção
• http://support.microsoft.com/kb/976138 · Aviso do Fabricante
• http://support.microsoft.com/kb/954157 · Aviso do Fabricante
• http://microsoft.com/technet/security/advisory/954157.mspx · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54645 · Nota
• http://securityfocus.com/archive/1/508335/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-4310 · Nota de Segurança
• http://securityfocus.com/bid/37251 · Nota
• http://osvdb.org/60856 · Nota
• http://zerodayinitiative.com/advisories/ZDI-09-090 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54643 · Nota