PT-2009-4905 · Microsoft · Windows Media Services+1

Peter Winter-Smith · Published 2009-09-08 · Updated 2023-12-07 · CVE-2009-2498

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows Media Format Runtime versions 9.0, 9.5, and 11 Windows Media Services versions 9.1 and 2008

Description The issue arises from the improper parsing of malformed headers in Advanced Systems Format (ASF) files, which can lead to the execution of arbitrary code. This can be achieved by a remote attacker through a crafted file with extensions such as .asf, .wmv, or .wma.

Recommendations For Microsoft Windows Media Format Runtime versions 9.0, 9.5, and 11, update to a version that properly handles ASF file headers to prevent arbitrary code execution. For Windows Media Services versions 9.1 and 2008, apply the necessary patches or updates to ensure correct parsing of ASF file headers and prevent exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-2498

Affected Products

Windows Media Format Runtime

Windows Media Services

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2009-2498 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-047 · Vendor Advisory
• http://us-cert.gov/cas/techalerts/TA09-251A.html · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6257 · Note