Signature Detail

HTTP: MP3 Windows Media Playback Memory Corruption

This signature detects attempts to exploit a known vulnerability against Microsoft Windows Media Player. A successful attack can lead to arbitrary code execution.

Extended Description

Microsoft Windows is prone to a remote code-execution vulnerability that arises when an affected Windows component handles a malicious MP3 file. Successful exploits may allow attackers to execute arbitrary code with the privileges of the currently logged-in user. Failed attacks will cause denial-of-service conditions.

Affected Products

• Microsoft microsoft_media_foundation
• Microsoft windows_media_format 11
• Microsoft windows_media_format 9.0
• Microsoft windows_media_format 9.5
• Microsoft windows_media_format 9.5 x64
• Nortel_networks callpilot 1002Rp
• Nortel_networks callpilot 1005R
• Nortel_networks callpilot 201I
• Nortel_networks callpilot 202I
• Nortel_networks callpilot 600R
• Nortel_networks callpilot 703T
• Nortel_networks contact_center_administration
• Nortel_networks contact_center_express
• Nortel_networks contact_center_manager_server
• Nortel_networks contact_center_ncc
• Nortel_networks contact_center-tapi_server
• Nortel_networks self-service-ccss7
• Nortel_networks self-service_ccxml
• Nortel_networks self-service_mps_100
• Nortel_networks self-service_mps_1000
• Nortel_networks self-service_mps_500
• Nortel_networks self-service_peri_application
• Nortel_networks self-service_peri_workstation
• Nortel_networks self-service_speech_server
• Nortel_networks self_service_voicexml
• Nortel_networks self-service_wvads
• Nortel_networks symposium_agent

References

• BugTraq: 36228
• CVE: CVE-2009-2499