Signature Detail

APP: Windows Media Player DirectShow Vulnerability (HTTP)

This signature detects invalid AVI files sent through HTTP. Malicious Web servers can entice visitors to view corrupted AVI files. A successful attack can allow code execution on a Microsoft Windows system.

Extended Description

A buffer overflow vulnerability exists in the Microsoft Windows DirectX component. This issue is related to processing of .AVI (Audio Visual Interleave) media files. The specific vulnerability exists in DirectShow and could be exposed through applications that employ DirectShow to process .AVI files. Successful exploitation will permit execution of arbitrary code in the context of the user who opens a malicious .AVI file. This issue could be exploited through any means that will allow the attacker to deliver a malicious .AVI file to a victim user. In Web-based attack scenarios, exploitation could occur automatically if the malicious Web page can cause the .AVI file to be loaded automatically by Windows Media Player. Other attack vectors such as email or instant messaging may require the victim user to manually open the malicious .AVI. It is not known if third-party applications rely on DirectShow to process .AVI files. If so, these applications could also present an attack vector.

Affected Products

• Avaya DefinityOne Media Servers R10
• Avaya DefinityOne Media Servers R11
• Avaya DefinityOne Media Servers R12
• Avaya DefinityOne Media Servers R6
• Avaya DefinityOne Media Servers R7
• Avaya DefinityOne Media Servers R8
• Avaya DefinityOne Media Servers R9
• Avaya DefinityOne Media Servers
• Avaya IP600 Media Servers R10
• Avaya IP600 Media Servers R11
• Avaya IP600 Media Servers R12
• Avaya IP600 Media Servers R6
• Avaya IP600 Media Servers R7
• Avaya IP600 Media Servers R8
• Avaya IP600 Media Servers R9
• Avaya IP600 Media Servers
• Avaya S3400 Message Application Server
• Avaya S8100 Media Servers R10
• Avaya S8100 Media Servers R11
• Avaya S8100 Media Servers R12
• Avaya S8100 Media Servers R6
• Avaya S8100 Media Servers R7
• Avaya S8100 Media Servers R8
• Avaya S8100 Media Servers R9
• Avaya S8100 Media Servers
• Avaya Unified Communication Center
• Microsoft DirectX 7.0
• Microsoft DirectX 8.0
• Microsoft DirectX 8.0 a
• Microsoft DirectX 8.1
• Microsoft DirectX 8.1 a
• Microsoft DirectX 8.1 b
• Microsoft DirectX 8.2
• Microsoft DirectX 9.0
• Microsoft DirectX 9.0 a
• Microsoft DirectX 9.0b
• Microsoft DirectX 9.0 c
• Microsoft Small Business Server 2003
• Microsoft Windows 2000 Advanced Server SP4
• Microsoft Windows 2000 Datacenter Server SP4
• Microsoft Windows 2000 Professional SP4
• Microsoft Windows 2000 Server SP4
• Microsoft Windows 98
• Microsoft Windows 98SE
• Microsoft Windows ME
• Microsoft Windows Media Player 9.0
• Microsoft Windows Server 2003 Datacenter Edition SP1
• Microsoft Windows Server 2003 Datacenter Edition
• Microsoft Windows Server 2003 Datacenter Edition Itanium SP1
• Microsoft Windows Server 2003 Datacenter Edition Itanium
• Microsoft Windows Server 2003 Datacenter x64 Edition
• Microsoft Windows Server 2003 Enterprise Edition SP1
• Microsoft Windows Server 2003 Enterprise Edition
• Microsoft Windows Server 2003 Enterprise Edition Itanium SP1
• Microsoft Windows Server 2003 Enterprise Edition Itanium
• Microsoft Windows Server 2003 Enterprise x64 Edition
• Microsoft Windows Server 2003 Standard Edition SP1
• Microsoft Windows Server 2003 Standard Edition
• Microsoft Windows Server 2003 Standard x64 Edition
• Microsoft Windows Server 2003 Web Edition SP1
• Microsoft Windows Server 2003 Web Edition
• Microsoft Windows XP Home SP1
• Microsoft Windows XP Home SP2
• Microsoft Windows XP Media Center Edition SP1
• Microsoft Windows XP Media Center Edition SP2
• Microsoft Windows XP Professional SP1
• Microsoft Windows XP Professional SP2
• Microsoft Windows XP Professional x64 Edition
• Microsoft Windows XP Tablet PC Edition SP1
• Microsoft Windows XP Tablet PC Edition SP2
• Nortel Networks CallPilot 1.0.7
• Nortel Networks CallPilot 2.0.0
• Nortel Networks CallPilot 3.0.0
• Nortel Networks CallPilot 4.0.0
• Nortel Networks Centrex IP Client Manager 2.5.0
• Nortel Networks Centrex IP Element Manager 2.5.0

References

• BugTraq: 15063
• CVE: CVE-2005-2128