Signature Detail

HTTP: Microsoft Windows Media Format ASF Parsing Code Execution

This signature detects attempts to exploit a known multiple buffer overflow vulnerabilities in Microsoft Windows Media Format processing engine. It is caused due to a boundary error when processing Advanced Systems Format (ASF) files. A remote attacker can exploit this by enticing the target user to open crafted ASF file, which if successful, allows arbitrary code to be injected and executed in the security context of the currently logged in user. The behavior of the target host is entirely dependent on the intended function of the injected code. In an unsuccessful attack, the affected application stops functioning and terminates.

Extended Description

Windows Media Player is prone to a remote code-execution vulnerability because it fails to properly handle malformed media files. Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the user running the application. Failed exploit attempts likely result in denial-of-service conditions.

Affected Products

• Avaya Messaging Application Server MM 1.1
• Avaya Messaging Application Server MM 2.0
• Avaya Messaging Application Server MM 3.0
• Avaya Messaging Application Server MM 3.1
• Avaya Messaging Application Server
• HP Storage Management Appliance 2.1
• HP Storage Management Appliance I
• HP Storage Management Appliance II
• HP Storage Management Appliance III
• Microsoft Windows Media Format 11
• Microsoft Windows Media Format 7.1
• Microsoft Windows Media Format 9.0
• Microsoft Windows Media Format 9.5
• Microsoft Windows Media Format 9.5 x64
• Microsoft Windows Media Services 9.1
• Microsoft Windows Media Services 9.1 x64

References

• BugTraq: 26776
• CVE: CVE-2007-0064