============================================================================================ Microsoft DirectX 9 Video Mixer Renderer(msvidctl.dll) ActiveX Multiple Remote Vulnerabilities =========================================================================================== by Asheesh Kumar Mani Tripathi # Vulnerability Discovered By Asheesh kumar Mani Tripathi # email informationhacker08@gmail.com # company www.aksitservices.co.in # Credit by Asheesh Anaconda # Date 25th Sep 2010 # Description: Microsoft DirectX 9 Video Mixer Renderer ActiveX object corresponding to msvidctl.dll is susceptible to multiple vulnerabilities, including buffer overflow and integer overflow vulnerabilities. An attacker can exploit this issue by enticing an unsuspecting user to view a malicious webpage. Successful exploits will allow the attacker to execute arbitrary code within the context of the application (typically Internet Explorer) that uses the ActiveX control. It calls CustomCompositorClas in a separate thread. The classid of the affected ActiveX control is 24DC3975-09BF-4231-8655-3EE71F43837D. By enticing a user to visit a malicious page, an attacker can exploit this vulnerability in order to execute arbitrary code on a target's machine. =============================================Proof Of Concept=============================================