Intrusion PreventionMS.DirectShow.L21.Remote.Code.Execution
Description
This indicates a possible attack against a Remote Code Execution vulnerability in Microsoft DirectShow platform.
The vulnerability is caused due to how L21's implementation of the control command in line 32 caption protocol. Successful attacks may allow attackers to execute arbitrary code on the vulnerable system.
Affected Products
Windows XP Service Pack 3
Windows XP Media Center Edition 2005 Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for Itanium-based Systems
Windows Media Center TV Pack for Windows Vista (32-bit editions)
Windows Media Center TV Pack for Windows Vista (64-bit editions)
Impact
System Compromise: Remote attackers can gain control of vulnerable systems.
Recommended Actions
Refer to the vendor's web site for suggested workaround:
http://www.microsoft.com/technet/security/Bulletin/ms12-004.mspx
Telemetry
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
| ID | 30737 |
| Created | Jan 12, 2012 |
| Updated | Nov 15, 2021 |
| Risk |
|
| CVE ID | CVE-2012-0004 |
| Exploit Prediction Score | 87.7% |
| Default Action | drop |
| Active | |
| Affected OS | Windows |
| Affected App | Other |