Signature Detail

HTTP: Download of Malicious MovieMaker File

This signature detects attempts to exploit a known vulnerability in the Microsoft MovieMaker. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the user.

Extended Description

Microsoft Windows Movie Maker is prone to a remote buffer-overflow vulnerability. An attacker can exploit this issue to execute arbitrary code with the privileges of the user running the application. Failed exploit attempts will cause a denial-of-service condition.

Affected Products

• Microsoft windows_movie_maker 2.1
• Microsoft windows_movie_maker 2.1.4027.0
• Microsoft windows_movie_maker 2.6
• Microsoft windows_movie_maker 6.0
• Microsoft windows_vista Business SP1
• Microsoft windows_vista Business SP2
• Microsoft windows_vista Enterprise SP1
• Microsoft windows_vista Enterprise SP2
• Microsoft windows_vista Home Basic SP1
• Microsoft windows_vista Home Basic SP2
• Microsoft windows_vista Home Premium SP1
• Microsoft windows_vista Home Premium SP2
• Microsoft windows_vista SP1
• Microsoft windows_vista SP2
• Microsoft windows_vista Ultimate SP1
• Microsoft windows_vista Ultimate SP2
• Microsoft windows_vista_business_64-bit_edition SP1
• Microsoft windows_vista_business_64-bit_edition SP2
• Microsoft windows_vista_december_ctp SP1
• Microsoft windows_vista_december_ctp SP2
• Microsoft windows_vista_enterprise_64-bit_edition SP1
• Microsoft windows_vista_enterprise_64-bit_edition SP2
• Microsoft windows_vista_home_basic_64-bit_edition SP1
• Microsoft windows_vista_home_basic_64-bit_edition SP2
• Microsoft windows_vista_home_premium_64-bit_edition SP1
• Microsoft windows_vista_home_premium_64-bit_edition SP2
• Microsoft windows_vista_ultimate_64-bit_edition SP1
• Microsoft windows_vista_ultimate_64-bit_edition SP2
• Microsoft windows_vista_x64_edition SP1
• Microsoft windows_vista_x64_edition SP2
• Microsoft windows_xp_embedded SP3
• Microsoft windows_xp_home SP3
• Microsoft windows_xp_media_center_edition SP3
• Microsoft windows_xp_professional SP3
• Microsoft windows_xp_professional_x64_edition SP2
• Microsoft windows_xp_professional_x64_edition SP3
• Microsoft windows_xp_tablet_pc_edition SP3

References

• BugTraq: 42268
• CVE: CVE-2010-2564
• URL: http://www.microsoft.com/technet/security/bulletin/ms10-050.mspx