Signature Detail

HTTP: Microsoft Windows Cinepak Codec Code Execution

This signature detects attempts to exploit a known remote code execution vulnerability in the Microsoft Windows Cinepak Codec. It is caused by a improper handling of VIDC (Cinepak) streams within the iccvid.dll module. An attacker can exploit this by enticing a target user to open a specially crafted AVI file. In a successful code execution attack, the injected code is executed within the context of the currently logged in user. In an unsuccessful attack, the affected application can terminate abnormally, leading to a denial-of-service condition.

Extended Description

Microsoft Windows is prone to a remote code-execution vulnerability when handling compressed media files. An attacker can exploit this issue by enticing an unsuspecting user to open a malicious file or visit a website containing malicious streaming media content. A successful exploit may allow arbitrary code to run in the context of the currently logged-in user.

Affected Products

• Microsoft Windows 7 for 32-bit Systems
• Microsoft Windows 7 for Itanium-based Systems
• Microsoft Windows 7 for x64-based Systems
• Microsoft Windows 7 Home Premium
• Microsoft Windows 7 Professional
• Microsoft Windows 7 Starter
• Microsoft Windows 7 Ultimate
• Microsoft Windows Vista Business SP1
• Microsoft Windows Vista Business SP2
• Microsoft Windows Vista Enterprise SP1
• Microsoft Windows Vista Enterprise SP2
• Microsoft Windows Vista Home Basic SP1
• Microsoft Windows Vista Home Basic SP2
• Microsoft Windows Vista Home Premium SP1
• Microsoft Windows Vista Home Premium SP2
• Microsoft Windows Vista SP1
• Microsoft Windows Vista SP2
• Microsoft Windows Vista Ultimate SP1
• Microsoft Windows Vista Ultimate SP2
• Microsoft Windows Vista Business 64-bit edition SP1
• Microsoft Windows Vista Business 64-bit edition SP2
• Microsoft Windows Vista Enterprise 64-bit edition SP1
• Microsoft Windows Vista Enterprise 64-bit edition SP2
• Microsoft Windows Vista Home Basic 64-bit edition SP1
• Microsoft Windows Vista Home Basic 64-bit edition SP2
• Microsoft Windows Vista Home Premium 64-bit edition SP1
• Microsoft Windows Vista Home Premium 64-bit edition SP2
• Microsoft Windows Vista Ultimate 64-bit edition SP1
• Microsoft Windows Vista Ultimate 64-bit edition SP2
• Microsoft Windows Vista x64 Edition SP1
• Microsoft Windows Vista x64 Edition SP2
• Microsoft Windows XP Home SP3
• Microsoft Windows XP Media Center Edition SP3
• Microsoft Windows XP Professional SP3
• Microsoft Windows XP Professional x64 Edition SP2
• Microsoft Windows XP Tablet PC Edition SP2

References

• BugTraq: 42256
• CVE: CVE-2010-2553