| Name | MS.DirectShow.AVI.Invalid.JPEGP.Marker.Memory.Corruption |
| Last Updated Date | Jun 23, 2009 |
| Release Date | Apr 14, 2009 |
| Severity | Critical |
| Impact | System Compromise: Remote attackers can gain control of vulnerable systems. |
| Description | This indicates an attack attempt to exploit a memory-corruption vulnerability
in Microsoft DirectShow.
The vulnerability is caused by an error when the affected software handles specially crafted MJPEG files. Successful exploitation may lead to remote code execution. |
| Affected Products | Microsoft Windows 2000 Service Pack with DirectX 8.1
Microsoft Windows 2000 Service Pack 4 with DirectX 9.0
Windows XP Service Pack 2 and Windows XP Service Pack 3 with DirectX 9.0
Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2 with DirectX 9.0
Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2 with DirectX 9.0
Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2 with DirectX 9.0
Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems with DirectX 9.0 |
| Recommended Actions | Apply the patch, available from the vendor's website:
http://www.microsoft.com/technet/security/Bulletin/ms09-011.mspx |
| Common Vulnerabilities and Exposures (CVE) | http://cve.mitre.org/cgi-bin/cvename.cgi?name=2009-0084
|
| Microsoft Bulletin ID | MS09-011 http://www.microsoft.com/technet/security/Bulletin/ms09-011.mspx |