PT-2010-3503 · Microsoft · Media Encoder+4

Publicado 2010-06-08 · Atualizado 2018-10-12 · CVE-2010-1879

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows Media Format Runtime versions 9 through 11 Media Encoder version 9

Description The issue allows remote attackers to execute arbitrary code via a media file with crafted compression data. This is related to an unspecified vulnerability in Quartz.dll for DirectShow and also affects the Asycfilt.dll COM component.

Recommendations For Windows Media Format Runtime versions 9 through 11, update to a version that contains a fix for this issue. For Media Encoder version 9, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting the use of media files with crafted compression data to minimize the risk of exploitation.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2010-1879

Produtos afetados

Asycfilt.Dll

Directshow

Media Encoder

Quartz.Dll

Windows Media Format Runtime

Referências · 4

• http://us-cert.gov/cas/techalerts/TA10-159B.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-1879 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-033 · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7517 · Nota