Signature Detail

HTTP: ASF Sample Rate Code Execution

This signature detects attempts to exploit a known vulnerability in the Microsoft Windows Media Runtime ASF parser. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the user.

Extended Description

Microsoft Windows Media Runtime is prone to a remote code-execution vulnerability because it fails to properly bounds-check user-supplied input. An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

Affected Products

• Microsoft audio_compression_manager
• Microsoft directshow_wma_voice_codec
• Microsoft windows_media_audio_voice_decoder
• Microsoft windows_media_player 10.0
• Microsoft windows_media_player 11
• Nortel_networks callpilot 1002Rp
• Nortel_networks callpilot 200I
• Nortel_networks callpilot 201I
• Nortel_networks callpilot 702T
• Nortel_networks callpilot 703T
• Nortel_networks contact_center_administration
• Nortel_networks contact_center_express
• Nortel_networks contact_center_manager_server
• Nortel_networks contact_center_multimedia
• Nortel_networks contact_center_ncc
• Nortel_networks contact_center-tapi_server
• Nortel_networks self-service-ccss7
• Nortel_networks self-service_ccxml
• Nortel_networks self-service_mps_100
• Nortel_networks self-service_mps_1000
• Nortel_networks self-service_mps_500
• Nortel_networks self-service_peri_application
• Nortel_networks self-service_peri_workstation
• Nortel_networks self-service_speech_server
• Nortel_networks self_service_voicexml
• Nortel_networks self-service_wvads
• Nortel_networks symposium_express_contact_center 4.2

References

• BugTraq: 36614
• BugTraq: 36644
• CVE: CVE-2009-0555
• CVE: CVE-2009-2527