---------------------------------------------------------------------- 2003: 2,700 advisories published 2004: 3,100 advisories published 2005: 4,600 advisories published 2006: 5,300 advisories published How do you know which Secunia advisories are important to you? The Secunia Vulnerability Intelligence Solutions allows you to filter and structure all the information you need, so you can address issues effectively. Get a free trial of the Secunia Vulnerability Intelligence Solutions: http://corporate.secunia.com/how_to_buy/38/vi/?ref=secadv ---------------------------------------------------------------------- TITLE: Windows Media Format Runtime ASF Parsing Vulnerability SECUNIA ADVISORY ID: SA28034 VERIFY ADVISORY: http://secunia.com/advisories/28034/ CRITICAL: Highly critical IMPACT: System access WHERE: >From remote OPERATING SYSTEM: Microsoft Windows XP Professional http://secunia.com/product/22/ Microsoft Windows XP Home Edition http://secunia.com/product/16/ Microsoft Windows Vista http://secunia.com/product/13223/ Microsoft Windows Storage Server 2003 http://secunia.com/product/12399/ Microsoft Windows Server 2003 Web Edition http://secunia.com/product/1176/ Microsoft Windows Server 2003 Standard Edition http://secunia.com/product/1173/ Microsoft Windows Server 2003 Enterprise Edition http://secunia.com/product/1174/ Microsoft Windows Server 2003 Datacenter Edition http://secunia.com/product/1175/ Microsoft Windows 2000 Server http://secunia.com/product/20/ Microsoft Windows 2000 Professional http://secunia.com/product/1/ Microsoft Windows 2000 Datacenter Server http://secunia.com/product/1177/ Microsoft Windows 2000 Advanced Server http://secunia.com/product/21/ SOFTWARE: Microsoft Windows Media Format Runtime 9.x http://secunia.com/product/16898/ Microsoft Windows Media Format Runtime 7.x http://secunia.com/product/16897/ Microsoft Windows Media Format Runtime 11.x http://secunia.com/product/16899/ Microsoft Windows Media Services 9.x http://secunia.com/product/16900/ DESCRIPTION: A vulnerability has been reported in Windows Media Format Runtime / Windows Media Services, which can be exploited by malicious people to compromise a user's system. The vulnerability is caused due to an error when parsing ASF (Advanced Systems Format) files and can be exploited when a user views a specially crafted ASF file in an application using the component (e.g. Windows Media Player). Successful exploitation may allow execution of arbitrary code. SOLUTION: Apply patches. Windows 2000 SP4 with Windows Media Format Runtime 7.1: http://www.microsoft.com/downloads/details.aspx?FamilyID=eecdf2ce-9aa7-4f0c-b62b-2fa7a32f369e Windows 2000 SP4 with Windows Media Format Runtime 9: http://www.microsoft.com/downloads/details.aspx?FamilyID=eecdf2ce-9aa7-4f0c-b62b-2fa7a32f369e Windows XP SP2 with Windows Media Format Runtime 9: http://www.microsoft.com/downloads/details.aspx?FamilyID=bece702a-6e61-433e-8275-20f4e84f2c92 Windows XP SP2 with Windows Media Format Runtime 9.5: http://www.microsoft.com/downloads/details.aspx?FamilyID=bece702a-6e61-433e-8275-20f4e84f2c92 Windows XP Professional x64 Edition (optionally with SP2) with Windows Media Format Runtime 9.5: http://www.microsoft.com/downloads/details.aspx?FamilyID=81f20b45-dfc7-4ddf-a4b4-6c0e9476ed51 Windows Server 2003 SP1/SP2 with Windows Media Format Runtime 9.5: http://www.microsoft.com/downloads/details.aspx?FamilyID=8fea7da8-a7f3-4786-97c2-fb5ea7018159 Windows Server 2003 x64 Edition (optionally with SP2) with Windows Media Format Runtime 9.5: http://www.microsoft.com/downloads/details.aspx?FamilyID=ffc69c76-02f1-4b15-8ec1-dab8c7e33bd4 Windows XP Professional x64 Edition (optionally with SP2) with Windows Media Format Runtime 9.5 x64 Edition: http://www.microsoft.com/downloads/details.aspx?FamilyID=72d2ca0e-da81-45ee-9321-4970b80f4a5a Windows Server 2003 x64 Edition (optionally with SP2) with Windows Media Format Runtime 9.5 x64 Edition: http://www.microsoft.com/downloads/details.aspx?FamilyID=ffc69c76-02f1-4b15-8ec1-dab8c7e33bd4 Windows XP SP2 with Windows Media Format Runtime 11: http://www.microsoft.com/downloads/details.aspx?FamilyID=bece702a-6e61-433e-8275-20f4e84f2c92 Windows XP Professional x64 Edition (optionally with SP2) with Windows Media Format Runtime 11: http://www.microsoft.com/downloads/details.aspx?FamilyID=1037b224-ac89-4efd-b189-6f3da77a88e6 Windows Vista with Windows Media Format Runtime 11: http://www.microsoft.com/downloads/details.aspx?FamilyID=9a98ef96-bc2e-42b7-9a24-c82c8fb379db Windows Vista x64 Edition with Windows Media Format Runtime 11: http://www.microsoft.com/downloads/details.aspx?FamilyID=3ce02c95-d695-4f14-9fb3-30c83a9cfb9c Windows Server 2003 SP1/SP2 with Windows Media Services 9.1: http://www.microsoft.com/downloads/details.aspx?FamilyID=096711d4-ce01-45d0-9c2d-ebfa5c671b9f Windows Server 2003 x64 Edition (optionally with SP2) with Windows Media Services 9.1 x64 Edition: http://www.microsoft.com/downloads/details.aspx?FamilyID=23c23800-5aaa-455b-96bf-4ead4dfdd95d PROVIDED AND/OR DISCOVERED BY: The vendor credits Ryan Smith, ISS X-Force. ORIGINAL ADVISORY: MS07-068 (KB941569 / KB944275): http://www.microsoft.com/technet/security/Bulletin/MS07-068.mspx ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------