Executive Summary
Summary | |
---|---|
Title | Vulnerability in Microsoft DirectShow Could Allow Remote Code Execution |
Informations | |||
---|---|---|---|
Name | KB971778 | First vendor Publication | 2009-05-28 |
Vendor | Microsoft | Last vendor Modification | 2009-07-14 |
Severity (Vendor) | N/A | Revision | 2.0 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 9.3 | Attack Range | Network |
Cvss Impact Score | 10 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Microsoft has completed the investigation into a public report of this vulnerability. We have issued MS09-028 to address this issue. For more information about this issue, including download links for an available security update, please review MS09-028. The vulnerability addressed is the DirectX NULL Byte Overwrite Vulnerability - CVE-2009-1537. |
Original Source
Url : http://www.microsoft.com/technet/security/advisory/971778.mspx |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:6237 | |||
Oval ID: | oval:org.mitre.oval:def:6237 | ||
Title: | DirectX NULL Byte Overwrite Vulnerability | ||
Description: | Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted QuickTime media file, as exploited in the wild in May 2009, aka "DirectX NULL Byte Overwrite Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2009-1537 | Version: | 4 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 | Product(s): | DirectX |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
SAINT Exploits
Description | Link |
---|---|
Microsoft DirectX DirectShow QuickTime movie parsing vulnerability | More info here |
OpenVAS Exploits
Date | Description |
---|---|
2009-07-15 | Name : Microsoft DirectShow Remote Code Execution Vulnerability (961373) File : nvt/secpod_ms09-028.nasl |
2009-06-01 | Name : Vulnerability in Microsoft DirectShow Could Allow Remote Code Execution File : nvt/secpod_ms_directx_code_exec_vuln.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
54797 | Microsoft DirectX DirectShow quartz.dll QuickTime NULL Byte Overwrite Arbitra... |
Snort® IPS/IDS
Date | Description |
---|---|
2014-01-10 | Microsoft Windows AVI DirectShow QuickTime parsing overflow attempt RuleID : 23565 - Revision : 4 - Type : FILE-MULTIMEDIA |
2014-01-10 | Microsoft Windows AVI DirectShow QuickTime parsing overflow attempt RuleID : 15517 - Revision : 18 - Type : FILE-MULTIMEDIA |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2009-07-14 | Name : It is possible to execute arbitrary code on the remote Windows host using Dir... File : smb_nt_ms09-028.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2013-05-11 00:46:47 |
|