CERT-In Advisory
CIAD-2009-0060
Multiple Remote Code Execution Vulnerabilities in Microsoft Windows Media Player Indeo Codec
Original Issue Date: December 21, 2009
Severity Rating: Medium
Systems Affected
- Microsoft Windows 2000 Service Pack 4
- Microsoft Windows XP Service Pack 2
- Windows XP Service Pack 3
- Microsoft Windows XP Professional x64 Edition Service Pack 2
- Microsoft Windows Server 2003 Service Pack 2
- Microsoft Windows Server 2003 x64 Edition Service Pack 2
- Microsoft Windows Server 2003 with SP2 for Itanium-based Systems
Component Affected
- Microsoft Windows Media Player
Overview
Multiple vulnerabilities have been reported in Microsoft Windows Media Player Indeo Codec which could allow remote attacker to execute arbitrary code on the affected system.
Description
The Microsoft media player Indeo Codec is used to decompresses digital media files for use in applications like Windows Media Player and Internet Explorer.
Multiple vulnerabilities exist in Microsoft Windows Media Player Indeo Codec, which could allow remote code execution. These vulnerabilities are caused due to memory corruption and buffer overflow errors in Indeo41 codec when processing media content files. A remote attacker could exploit these vulnerabilities by enticing users to open or visit malicious website containing specially crafted malformed media content files, which could trigger memory corruption condition and allows remote code execution or cause application crash on affected systems.
Workaround
- Unregister the Indeo codec
- Keep windows updated
- Do not open media files received from untrusted and unknown sources
- Do not open unexpected mails and media file attachments received from trusted sources
- Do not visit untrusted websites or click URLs provided in emails.
- Exercise caution while opening media files received through email attachments
Vendor Information
Microsoft
http://www.microsoft.com/technet/security/advisory/954157.mspx
References
Microsoft
http://www.microsoft.com/technet/security/advisory/954157.mspx
http://support.microsoft.com/kb/954157
Fortiguard
http://www.fortiguard.com/advisory/FGA-2009-45.html
VUPEN
http://www.vupen.com/english/advisories/2009/3440
Zerodayinitiative
http://zerodayinitiative.com/advisories/ZDI-09-090/
SecurityTracker
http://securitytracker.com/alerts/2009/Dec/1023302.html
XFORCE-ISS
http://xforce.iss.net/xforce/xfdb/54645
http://xforce.iss.net/xforce/xfdb/54642
SecurityFocus
http://www.securityfocus.com/bid/37251
Secunia
http://secunia.com/advisories/37592
CVE Name
CVE-2009-4210
CVE-2009-4309
CVE-2009-4310
CVE-2009-4311
CVE-2009-4312
CVE-2009-4313
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|