PT-2011-3547 · Microsoft · Windows Vista+3

Published 2011-10-11 · Updated 2023-12-07 · CVE-2011-2009

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows Vista SP2 Microsoft Windows 7 Gold and SP1 Windows Media Center TV Pack for Windows Vista

Description A remote code execution issue exists in the way Windows Media Center handles the loading of DLL files, allowing an attacker to take complete control of an affected system. This could enable the installation of programs, viewing, changing, or deleting data, or creating new accounts with full user rights. Users with fewer user rights on the system could be less impacted than those operating with administrative user rights.

Recommendations For Microsoft Windows Vista SP2, update to a version that includes the fix for this issue. For Microsoft Windows 7 Gold and SP1, update to a version that includes the fix for this issue. For Windows Media Center TV Pack for Windows Vista, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting the loading of DLL files from untrusted locations to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2011-2009

Affected Products

Windows

Windows 7

Windows Media Center Tv Pack

Windows Vista

References · 5

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-076 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-2009 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2009 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12934 · Note
• http://technet.microsoft.com/en-us/security/bulletin/MS11-076 · Note