OSVDB ID: 47962

Title: Microsoft Windows Media Encoder wmex.dll ActiveX Overflow

Info

Disclosure
Sep 09, 2008

Discovery
Unknown

Dates

Exploit
Unknown

Solution
Sep 09, 2008

Description

 A buffer overflow exists in Windows. The wmex.dll ActiveX control fails to validate data passed to the GetDetailsString method resulting in a stack overflow. With a specially crafted web site, a context-dependent attacker can cause arbitrary code execution resulting in a loss of integrity.

Classification

 Location: Remote / Network Access, Local / Remote, Context Dependent
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Patch / RCS
Exploit: Exploit Public, Exploit Commercial
Disclosure: Vendor Verified, Vendor Verified, Coordinated Disclosure

Solution

 Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability.

Products

Microsoft Corporation

Windows

 XP SP2
XP Pro x64
2003 Server SP2
2003 Server x64
2003 Server SP1
2003 Server x64 SP2
2008 Server 32-bit
2000 SP4
Vista
XP Pro x64 SP2
2008 Server x64
Vista SP1
Vista x64
Vista x64 SP1
XP SP3

References

Credit
  • Nguyen Minh Duc -
  • Le Manh Tung -


Direct URL: http://osvdb.org/47962