Lucene search

MitreCVE-2009-4309

HistoryDec 13, 2009 - 1:30 a.m.

CVE-2009-4309

2009-12-1301:30:00

CWE-119

mitre

web.nvd.nist.gov

cve-2009-4309

buffer overflow

indeo41

codec

windows media player

microsoft windows

remote code execution

iv41

media file

avi file

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

7.9

Confidence

Low

EPSS

0.183

Percentile

96.2%

JSON

Heap-based buffer overflow in the Intel Indeo41 codec for Windows Media Player in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to execute arbitrary code via a large size value in a movi record in an IV41 stream in a media file, as demonstrated by an AVI file.

Affected configurations

Nvd

Node

microsoftwindows_media_player

AND

microsoftwindows_2000sp4

microsoftwindows_2003_serversp2

microsoftwindows_2003_serversp2itanium

microsoftwindows_2003_serversp2x64

microsoftwindows_xpsp3

microsoftwindows_xpMatch-sp2

microsoftwindows_xpMatch-sp2x64

VendorProductVersionCPE
microsoftwindows_media_player*cpe:2.3:a:microsoft:windows_media_player:*:*:*:*:*:*:*:*
microsoftwindows_2000*cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*
microsoftwindows_2003_server*cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:*
microsoftwindows_2003_server*cpe:2.3:o:microsoft:windows_2003_server:*:sp2:itanium:*:*:*:*:*
microsoftwindows_2003_server*cpe:2.3:o:microsoft:windows_2003_server:*:sp2:x64:*:*:*:*:*
microsoftwindows_xp*cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*
microsoftwindows_xp-cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:*:*:*:*
microsoftwindows_xp-cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	windows_media_player	*	cpe:2.3:a:microsoft:windows_media_player::::::::
microsoft	windows_2000	*	cpe:2.3:o:microsoft:windows_2000::sp4::::::*
microsoft	windows_2003_server	*	cpe:2.3:o:microsoft:windows_2003_server::sp2::::::*
microsoft	windows_2003_server	*	cpe:2.3:o:microsoft:windows_2003_server::sp2:itanium:::::
microsoft	windows_2003_server	*	cpe:2.3:o:microsoft:windows_2003_server::sp2:x64:::::
microsoft	windows_xp	*	cpe:2.3:o:microsoft:windows_xp::sp3::::::*
microsoft	windows_xp	-	cpe:2.3:o:microsoft:windows_xp:-:sp2::::::
microsoft	windows_xp	-	cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*

References

secunia.com/advisories/37592

securitytracker.com/id?1023302

support.microsoft.com/kb/954157

support.microsoft.com/kb/955759

support.microsoft.com/kb/976138

www.microsoft.com/technet/security/advisory/954157.mspx

www.osvdb.org/60855

www.securityfocus.com/archive/1/508324/100/0/threaded

www.securityfocus.com/bid/37251

www.vupen.com/english/advisories/2009/3440

zerodayinitiative.com/advisories/ZDI-09-089/

exchange.xforce.ibmcloud.com/vulnerabilities/54642

exchange.xforce.ibmcloud.com/vulnerabilities/54645

oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12188

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

7.9

Confidence

Low

EPSS

0.183

Percentile

96.2%

JSON

Related for CVE-2009-4309