Dangerous Microsoft DirectX vulnerability under attack

supag33k · **05-29-2009, 01:48 AM**

Microsoft today warned that hackers are using rigged QuickTime media files to exploit an unpatched vulnerability in DirectShow, the APIs used by Windows programs for multimedia support.

The company has activated its security response process to deal with the zero-day attacks has issued a pre-patch advisory with workarounds and a one-click “fix it” feature to enable the mitigations.

From the advisory:

Microsoft is aware of limited, active attacks that use this exploit code. While our investigation is ongoing, our investigation so far has shown that Windows 2000 Service Pack 4, Windows XP, and Windows Server 2003 are vulnerable; all versions of Windows Vista and Windows Server 2008 are not vulnerable.

Read more at zdnet.com ....

http://blogs.zdnet.com/security/?p=3465

Also an entry on the MSRC blog provides more details:

The vulnerability is in the QuickTime parser in Microsoft DirectShow. An attacker would try and exploit the vulnerability by crafting a specially formed video file and then posting it on a website or sending it as an attachment in e-mail. While this isn’t a browser vulnerability, because the vulnerability is in DirectShow, a browser-based vector is potentially accessible through any browser using media plug-ins that use DirectShow. Also, we’ve verified that it is possible to direct calls to DirectShow specifically, even if Apple’s QuickTime (which is not vulnerable) is installed.

The MSRC blog is here:

http://blogs.technet.com/msrc/archiv...-released.aspx

Tinus1959 · **03-17-2010, 07:32 AM**

Quote:

Originally Posted by removed

I am glad to catch idea from your article. It has information I have been searching for a long time. This looks absolutely perfect. All these tinny details are made with lot of background knowledge. I like it a lot.

Keep on taking action!
________________

Very good. That is what we are here for. Glad you liked it.

By the way, the website you promote in your post and your sig has nothing to to with the goal of the forum. I removed it.

BosonMichael · **03-17-2010, 09:10 AM**

Quote:

Originally Posted by Tinus1959

Very good. That is what we are here for. Glad you liked it.

By the way, the website you promote in your post and your sig has nothing to to with the goal of the forum. I removed it.

And he added it back. Banned.

Tinus1959 · **03-19-2010, 03:06 AM**

Good job.

supag33k · **03-26-2010, 05:09 AM**

Thanks fo the moderation fellows.

It looks like I have to revise the authentication questions again....sigh

btw - I am back around here more.

05-29-2009, 01:48 AM	#1
supag33k MCSE World Administrator Join Date: May 2003 Location: Australia Posts: 2,382 Thanks: 857 Thanked 172 Times in 142 Posts	Dangerous Microsoft DirectX vulnerability under attack Microsoft today warned that hackers are using rigged QuickTime media files to exploit an unpatched vulnerability in DirectShow, the APIs used by Windows programs for multimedia support. The company has activated its security response process to deal with the zero-day attacks has issued a pre-patch advisory with workarounds and a one-click “fix it” feature to enable the mitigations. From the advisory: Microsoft is aware of limited, active attacks that use this exploit code. While our investigation is ongoing, our investigation so far has shown that Windows 2000 Service Pack 4, Windows XP, and Windows Server 2003 are vulnerable; all versions of Windows Vista and Windows Server 2008 are not vulnerable. Read more at zdnet.com .... http://blogs.zdnet.com/security/?p=3465 Also an entry on the MSRC blog provides more details: The vulnerability is in the QuickTime parser in Microsoft DirectShow. An attacker would try and exploit the vulnerability by crafting a specially formed video file and then posting it on a website or sending it as an attachment in e-mail. While this isn’t a browser vulnerability, because the vulnerability is in DirectShow, a browser-based vector is potentially accessible through any browser using media plug-ins that use DirectShow. Also, we’ve verified that it is possible to direct calls to DirectShow specifically, even if Apple’s QuickTime (which is not vulnerable) is installed. The MSRC blog is here: http://blogs.technet.com/msrc/archiv...-released.aspx __________________ MCSE (NT4/2000/2003/Messaging) MCDBA (SQL 7/2000) Wireless specialist (RF and Microwave) WIP: CCNA, MCTS SQL 2005, MS Security stuff Focus your efforts on one certification objective at a time, preferably the one you are weakest on at that point in time, making the objective something you understand well. General Notes 1. The "Infocenter " along the top menu includes Book Reviews etc and is located in a separate section to the "General Forums" area

03-19-2010, 03:06 AM	#4
Tinus1959 Senior Moderator Join Date: Dec 2004 Location: The Netherlands. Posts: 4,919 Thanks: 173 Thanked 407 Times in 338 Posts	Re: Dangerous Microsoft DirectX vulnerability under attack Good job. __________________ There are 10 types of people: those who understand binary numbers and those who do not. Trainer is the most efficient job you could have: you sell your knowledge and still keep it yourself.

03-26-2010, 05:09 AM	#5
supag33k MCSE World Administrator Join Date: May 2003 Location: Australia Posts: 2,382 Thanks: 857 Thanked 172 Times in 142 Posts	Re: Dangerous Microsoft DirectX vulnerability under attack Thanks fo the moderation fellows. It looks like I have to revise the authentication questions again....sigh btw - I am back around here more. __________________ MCSE (NT4/2000/2003/Messaging) MCDBA (SQL 7/2000) Wireless specialist (RF and Microwave) WIP: CCNA, MCTS SQL 2005, MS Security stuff Focus your efforts on one certification objective at a time, preferably the one you are weakest on at that point in time, making the objective something you understand well. General Notes 1. The "Infocenter " along the top menu includes Book Reviews etc and is located in a separate section to the "General Forums" area

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Symantec and Sophos attack Microsoft OneCare	snoopy51	IT Security General	4	05-18-2007 10:51 AM
Microsoft Leaves Windows 98, Me Users In Lurch Over Metafile Vulnerability	jcb	Front Page News	0	01-06-2006 02:22 PM
DirectX 9.0c Redistributable released	ashwin	Front Page News	0	10-05-2005 06:00 AM
Exploit code for Microsoft vulnerability circulating	QOD	Windows Server 2003	0	02-17-2004 04:32 PM
Microsoft shrugs off MyDoom attack	snoopy51	IT Security General	1	02-03-2004 06:14 PM