Technical Description

A vulnerability has been identified in Microsoft Windows, which could be exploited by remote attackers to cause a denial of service or take complete control of an affected system. This issue is caused due to incorrect parsing of Advanced Systems Format (ASF) files within the Windows Media Format Runtime, which could be exploited by remote attackes to execute arbitrary code by tricking a user into visiting a specially crafted wbe page.

Affected Products

Microsoft Windows Media Format Runtime 7.1
Microsoft Windows Media Format Runtime 9
Microsoft Windows Media Format Runtime 9.5
Microsoft Windows Media Format Runtime 9.5 x64 Edition
Microsoft Windows Media Format Runtime 11
Microsoft Windows Media Services 9.1

Microsoft Windows 2000 Service Pack 4
Microsoft Windows XP Service Pack 2
Microsoft Windows XP Professional x64 Edition
Microsoft Windows XP Professional x64 Edition Service Pack 2
Microsoft Windows Server 2003 Service Pack 1
Microsoft Windows Server 2003 Service Pack 2
Microsoft Windows Server 2003 x64 Edition
Microsoft Windows Server 2003 x64 Edition Service Pack 2
Microsoft Windows Vista
Microsoft Windows Vista x64 Edition

Solution

Apply patches :
http://www.microsoft.com/technet/security/bulletin/ms07-068.mspx

References

http://www.vupen.com/english/advisories/2007/4183
http://www.microsoft.com/technet/security/bulletin/ms07-066.mspx

Credits

Vulnerability reported by Ryan Smith and Alex Wheeler (IBM ISS X-Force).

ChangeLog

2007-12-11 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time alerts with CVE, CWE, and CVSS when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.