Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2010-0250 | First vendor Publication | 2010-02-10 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 9.3 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Heap-based buffer overflow in DirectShow in Microsoft DirectX, as used in the AVI Filter on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2, and in Quartz on Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7, allows remote attackers to execute arbitrary code via an AVI file with a crafted length field in an unspecified video stream, which is not properly handled by the RLE video decompressor, aka "DirectShow Heap Overflow Vulnerability." |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0250 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:8064 | |||
| Oval ID: | oval:org.mitre.oval:def:8064 | ||
| Title: | DirectShow Heap Overflow Vulnerability | ||
| Description: | Heap-based buffer overflow in DirectShow in Microsoft DirectX, as used in the AVI Filter on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2, and in Quartz on Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7, allows remote attackers to execute arbitrary code via an AVI file with a crafted length field in an unspecified video stream, which is not properly handled by the RLE video decompressor, aka "DirectShow Heap Overflow Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-0250 | Version: | 3 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2010-02-10 | Name : Microsoft DirectShow Remote Code Execution Vulnerability (977935) File : nvt/secpod_ms10-013.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 62257 | Microsoft Windows DirectShow AVI File Decompression Overflow Windows is prone to an overflow condition. DirectShow fails to properly sanitize user-supplied input resulting in a heap overflow. With a specially crafted AVI file, a context-dependent attacker can potentially cause arbitrary code execution. |
Information Assurance Vulnerability Management (IAVM)
| Date | Description |
|---|---|
| 2010-02-18 | IAVM : 2010-A-0025 - Microsoft DirectShow Remote Code Execution Vulnerability Severity : Category II - VMSKEY : V0022679 |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2017-10-10 | Microsoft DirectShow memory corruption attempt RuleID : 44306 - Revision : 2 - Type : OS-WINDOWS |
| 2017-10-10 | Microsoft DirectShow memory corruption attempt RuleID : 44305 - Revision : 2 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft DirectShow memory corruption attempt RuleID : 16415 - Revision : 9 - Type : OS-WINDOWS |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2010-02-09 | Name : It is possible to execute arbitrary code on the remote Windows host using Dir... File : smb_nt_ms10-013.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:09:25 |
|
| 2024-11-28 12:21:00 |
|
| 2024-08-02 12:13:02 |
|
| 2024-08-02 01:03:31 |
|
| 2024-02-02 01:12:32 |
|
| 2024-02-01 12:03:28 |
|
| 2023-12-07 21:28:04 |
|
| 2023-09-05 12:11:45 |
|
| 2023-09-05 01:03:19 |
|
| 2023-09-02 12:11:48 |
|
| 2023-09-02 01:03:21 |
|
| 2023-08-12 12:13:59 |
|
| 2023-08-12 01:03:20 |
|
| 2023-08-11 12:11:51 |
|
| 2023-08-11 01:03:29 |
|
| 2023-08-06 12:11:24 |
|
| 2023-08-06 01:03:22 |
|
| 2023-08-04 12:11:29 |
|
| 2023-08-04 01:03:24 |
|
| 2023-07-14 12:11:25 |
|
| 2023-07-14 01:03:22 |
|
| 2023-03-29 01:13:06 |
|
| 2023-03-28 12:03:28 |
|
| 2022-10-11 12:10:11 |
|
| 2022-10-11 01:03:10 |
|
| 2021-05-04 12:11:05 |
|
| 2021-04-22 01:11:34 |
|
| 2020-05-23 00:25:09 |
|
| 2018-10-31 00:20:02 |
|
| 2018-10-13 00:22:54 |
|
| 2018-10-11 00:19:46 |
|
| 2018-09-20 12:08:15 |
|
| 2017-09-19 09:23:37 |
|
| 2016-09-30 01:02:18 |
|
| 2016-08-31 12:02:02 |
|
| 2016-08-05 12:02:23 |
|
| 2016-06-28 18:00:31 |
|
| 2016-04-26 19:31:40 |
|
| 2014-02-17 10:53:29 |
|
| 2014-01-19 21:26:33 |
|
| 2013-11-11 12:38:36 |
|
| 2013-05-10 23:16:55 |
|
