PT-2009-2784 · Microsoft · Directshow+1

Piotr Bania · Published 2009-04-15 · Updated 2019-02-26 · CVE-2009-0084

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft DirectX versions 8.1 through 9.0

Description The issue is related to a use-after-free vulnerability in DirectShow, which can be exploited by remote attackers to execute arbitrary code. This can be achieved through an MJPEG file or video stream containing a malformed Huffman table. The vulnerability triggers an exception that frees heap memory, which is later accessed, leading to potential code execution.

Recommendations For Microsoft DirectX versions 8.1 through 9.0, update to a newer version that contains a fix for this issue.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-0084

Affected Products

Directshow

Directx

References · 11

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-011 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0084 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5618 · Note
• http://piotrbania.com/all/adv/ms-directx-mjpeg-adv.txt · Note
• http://secunia.com/advisories/34665 · Note
• http://support.avaya.com/elmodocs2/security/ASA-2009-132.htm · Note
• http://vupen.com/english/advisories/2009/1025 · Note
• http://osvdb.org/53632 · Note
• http://securitytracker.com/id?1022040 · Note
• http://securityfocus.com/bid/34460 · Note
• http://us-cert.gov/cas/techalerts/TA09-104A.html · Note