This application requires Javascript for optimal performance.

MS.DirectShow.L21.Remote.Code.Execution

Release Date

Jan 12, 2012

Severity

critical

Impact

System Compromise: Remote attackers can gain control of vulnerable systems.

Description

This indicates a possible attack against a Remote Code Execution vulnerability in Microsoft DirectShow platform.

The vulnerability is caused due to how L21's implementation of the control command in line 32 caption protocol. Successful attacks may allow attackers to execute arbitrary code on the vulnerable system.

Affected Products

Windows XP Service Pack 3
Windows XP Media Center Edition 2005 Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for Itanium-based Systems
Windows Media Center TV Pack for Windows Vista (32-bit editions)
Windows Media Center TV Pack for Windows Vista (64-bit editions)

Recommended Actions

Refer to the vendor's web site for suggested workaround:
http://www.microsoft.com/technet/security/Bulletin/ms12-004.mspx

Coverage

IPS
VCM

Common Vulnerabilities and Exposures (CVE)

CVE-2012-0004

Reference/s

http://blog.vulnhunt.com/index.php/2012/02/02/cal-2012-0004-opera-array-integer-overflow/
http://technet.microsoft.com/en-us/security/bulletin/MS12-004.mspx (MS-ID)

Reference: VID-30737