PT-2015-3668 · Divx · Directshowdemuxfilter+2

Publicado 2015-01-13 · Atualizado 2015-01-14 · CVE-2014-10024

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Divx Web Player (affected versions not specified) Divx Player (affected versions not specified) Other Divx plugins (affected versions not specified)

Description The issue is related to multiple integer signedness errors in the DirectShowDemuxFilter, which is used in various Divx products. This can be exploited by remote attackers to execute arbitrary code through a negative or large value in a Stream Format (STRF) chunk in an AVI file, leading to a heap-based buffer overflow.

Recommendations For Divx Web Player, update to a version that addresses the integer signedness errors in DirectShowDemuxFilter. For Divx Player, update to a version that addresses the integer signedness errors in DirectShowDemuxFilter. For other Divx plugins, update to a version that addresses the integer signedness errors in DirectShowDemuxFilter. As a temporary workaround, consider avoiding the use of AVI files with negative or large values in Stream Format (STRF) chunks until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2014-10024

Produtos afetados

Directshowdemuxfilter

Divx Player

Divx Web Player

Referências · 3

• 🔥 http://seclists.org/fulldisclosure/2014/Apr/283 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-10024 · Nota de Segurança
• http://securityfocus.com/bid/67086 · Nota