---------------------------------------------------------------------- 2003: 2,700 advisories published 2004: 3,100 advisories published 2005: 4,600 advisories published 2006: 5,300 advisories published How do you know which Secunia advisories are important to you? The Secunia Vulnerability Intelligence Solutions allows you to filter and structure all the information you need, so you can address issues effectively. Get a free trial of the Secunia Vulnerability Intelligence Solutions: http://corporate.secunia.com/how_to_buy/38/vi/?ref=secadv ---------------------------------------------------------------------- TITLE: Microsoft DirectX SAMI/WAV/AVI File Parsing Vulnerabilities SECUNIA ADVISORY ID: SA28010 VERIFY ADVISORY: http://secunia.com/advisories/28010/ CRITICAL: Highly critical IMPACT: System access WHERE: >From remote OPERATING SYSTEM: Microsoft Windows 2000 Server http://secunia.com/product/20/ Microsoft Windows 2000 Professional http://secunia.com/product/1/ Microsoft Windows 2000 Datacenter Server http://secunia.com/product/1177/ Microsoft Windows 2000 Advanced Server http://secunia.com/product/21/ Microsoft Windows Server 2003 Datacenter Edition http://secunia.com/product/1175/ Microsoft Windows Server 2003 Enterprise Edition http://secunia.com/product/1174/ Microsoft Windows Server 2003 Standard Edition http://secunia.com/product/1173/ Microsoft Windows Server 2003 Web Edition http://secunia.com/product/1176/ Microsoft Windows Storage Server 2003 http://secunia.com/product/12399/ Microsoft Windows Vista http://secunia.com/product/13223/ Microsoft Windows XP Home Edition http://secunia.com/product/16/ Microsoft Windows XP Professional http://secunia.com/product/22/ SOFTWARE: Microsoft DirectX 10.x http://secunia.com/product/16896/ Microsoft DirectX 7.x http://secunia.com/product/1913/ Microsoft DirectX 8.x http://secunia.com/product/1914/ Microsoft DirectX 9.x http://secunia.com/product/1915/ DESCRIPTION: Two vulnerabilities have been reported in Microsoft DirectX, which can be exploited by malicious people to compromise a user's system. 1) An error within the DirectShow technology when parsing SAMI (Synchronized Accessible Media Interchange) files can be exploited to execute arbitrary code on a user's system when a specially crafted file is opened. The vulnerability has been reported in DirectX 7.0 and 8.1 and later versions are not affected. 2) An error within the DirectShow technology when parsing AVI and WAV files can be exploited to execute arbitrary code on a user's system when e.g. visiting a malicious website. The vulnerability has been reported in DirectX 7.0 through 10.0. SOLUTION: Apply patches. Windows 2000 SP4 with DirectX 7.0: http://www.microsoft.com/downloads/details.aspx?FamilyId=06196774-5a11-4525-b53c-8cb000738949 Windows 2000 SP4 with DirectX 8.1: http://www.microsoft.com/downloads/details.aspx?FamilyId=ccb872bd-fc06-4a3f-ac70-3c9a42d57b37 Windows 2000 SP4 with DirectX 9.0c: http://www.microsoft.com/downloads/details.aspx?FamilyId=03b14ce0-5189-4803-8151-6ac5cb6a9179 Windows XP SP2 with DirectX 9.0c: http://www.microsoft.com/downloads/details.aspx?FamilyId=04a8f8d3-69f9-4445-baab-f45616a6b9b7 Windows XP Professional x64 Edition (optionally with SP2) with DirectX 9.0c: http://www.microsoft.com/downloads/details.aspx?FamilyId=f096c500-e765-4e75-8443-7ffec4ddf149 Windows Server 2003 SP1/SP2 with DirectX 9.0c: http://www.microsoft.com/downloads/details.aspx?FamilyId=d80a295a-baf9-4981-8a28-1b4207ecc5f7 Windows Server 2003 x64 Edition (optionally with SP2) with DirectX 9.0c: http://www.microsoft.com/downloads/details.aspx?FamilyId=378086ea-60b8-409f-970a-fcfd62025150 Windows Server 2003 with SP1/SP2 for Itanium-based systems with DirectX 9.0c: http://www.microsoft.com/downloads/details.aspx?FamilyId=2e6ea4bb-9f4f-46fb-9d51-e20b15e61a89 Windows Vista with DirectX 10.0: http://www.microsoft.com/downloads/details.aspx?FamilyId=bfa571bc-e43f-45e3-bc98-4086985c99aa Windows Vista x64 Edition with DirectX 10.0: http://www.microsoft.com/downloads/details.aspx?FamilyId=3d8803da-108b-4b9d-a039-84932dce8e42 PROVIDED AND/OR DISCOVERED BY: 1) The vendor credits Jun Mao, VeriSign iDefense Labs. 2) The vendor credits Peter Winter-Smith, NGSSoftware. ORIGINAL ADVISORY: MS07-064 (KB941568): http://www.microsoft.com/technet/security/Bulletin/MS07-064.mspx ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------