Microsoft Windows Media格式实时ASF文件远程代码执行漏洞

BUGTRAQ ID: 26776
CVE ID:CVE-2007-0064
CNCVE ID:CNCVE-20070064

Windows Media Format Runtime是一款windows media player10播放器的插件。
windows media player10 播放器的插件处理.ASF文件存在缓冲区溢出，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。
ASF文件格式由Windows Media Player处理，这个文件格式包含3个必要的头对象和流属性条目(Stream Property entries)，Stream Property entries存在4个漏洞：
-Audio_conceal_none条目，此条目相应的条目长度是一个任意短整数，可能构建任意长度值，在部分增加和截断后，会导致小缓冲区分配，如果遇到大的拷贝可导致堆溢出而允许任意代码执行。(XFID 38828-http://www.iss.net/threats/279.html)
-Degradable JPEG Media条目，这个条目此条目相应的条目长度是一个任意短整数，可能构建任意长度值，在部分增加和截断后，会导致小缓冲区分配，如果遇到大的拷贝可导致堆溢出而允许任意代码执行(XFID 38827 - http://www.iss.net/threats/279.html)。
-Error correction条目，这个条目此条目相应的条目长度是一个任意短整数，可能构建任意长度值，在部分增加和截断后，会导致小缓冲区分配，如果遇到大的拷贝可导致堆溢出而允许任意代码执行(XFID 38829 - http://www.iss.net/threats/279.html)。
-Stream Property entries也包含特定类型长度和一个错误修正数据长度，在这些整数上进行算术运算为了获得要分配内存块的大小。如果两个长度大小过大，可导致发生内存溢出而执行任意代码。

Microsoft Windows Media Services 9.1 x64

• Microsoft Windows Server 2003 Datacenter Edition
• Microsoft Windows Server 2003 Datacenter Edition Itanium 0
• Microsoft Windows Server 2003 Enterprise Edition
• Microsoft Windows Server 2003 Enterprise Edition Itanium 0
• Microsoft Windows Server 2003 Standard Edition
  Microsoft Windows Media Services 9.1
• Microsoft Windows Server 2003 Datacenter Edition
• Microsoft Windows Server 2003 Datacenter Edition Itanium 0
• Microsoft Windows Server 2003 Enterprise Edition
• Microsoft Windows Server 2003 Enterprise Edition Itanium 0
• Microsoft Windows Server 2003 Standard Edition
  Microsoft Windows Media Format 9.5 x64
  Microsoft Windows Media Format 9.5
  Microsoft Windows Media Format 9.0
  Microsoft Windows Media Format 7.1
  Microsoft Windows Media Format 11

补丁安装：
Microsoft Windows Media Services 9.1
Microsoft Security Update for Windows Server 2003 (KB944275) - English
Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2
<a href=“http://www.microsoft.com/downloads/details.aspx?FamilyID=096711d4-ce01” target=“_blank”>http://www.microsoft.com/downloads/details.aspx?FamilyID=096711d4-ce01</a> -45d0-9c2d-ebfa5c671b9f&displaylang=en
Microsoft Windows Media Format 11
Microsoft Security Update for Windows Media Format 11 Series for Windows XP x64 Edition (KB941569)
Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2
<a href=“http://www.microsoft.com/downloads/details.aspx?FamilyID=1037b224-ac89” target=“_blank”>http://www.microsoft.com/downloads/details.aspx?FamilyID=1037b224-ac89</a> -4efd-b189-6f3da77a88e6&displaylang=en
Microsoft Security Update for Windows Server 2003 (KB944275) - English
Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2
<a href=“http://www.microsoft.com/downloads/details.aspx?FamilyID=096711d4-ce01” target=“_blank”>http://www.microsoft.com/downloads/details.aspx?FamilyID=096711d4-ce01</a> -45d0-9c2d-ebfa5c671b9f&displaylang=en
Microsoft Security Update for Windows Vista (KB941569)
Windows Vista
<a href=“http://www.microsoft.com/downloads/details.aspx?FamilyID=9a98ef96-bc2e” target=“_blank”>http://www.microsoft.com/downloads/details.aspx?FamilyID=9a98ef96-bc2e</a> -42b7-9a24-c82c8fb379db&displaylang=en
Microsoft Security Update for Windows Vista for x64-based Systems (KB941569) - English
Windows Vista x64 Edition
<a href=“http://www.microsoft.com/downloads/details.aspx?FamilyID=3ce02c95-d695” target=“_blank”>http://www.microsoft.com/downloads/details.aspx?FamilyID=3ce02c95-d695</a> -4f14-9fb3-30c83a9cfb9c&displaylang=en
Microsoft Security Update for Windows XP (KB941569)
Windows XP Service Pack 2 & Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2
<a href=“http://www.microsoft.com/downloads/details.aspx?FamilyID=bece702a-6e61” target=“_blank”>http://www.microsoft.com/downloads/details.aspx?FamilyID=bece702a-6e61</a> -433e-8275-20f4e84f2c92&displaylang=en
Microsoft Windows Media Format 9.0
Microsoft Security Update for Windows 2000 (KB941569)
Microsoft Windows 2000 Service Pack 4
<a href=“http://www.microsoft.com/downloads/details.aspx?FamilyID=eecdf2ce-9aa7” target=“_blank”>http://www.microsoft.com/downloads/details.aspx?FamilyID=eecdf2ce-9aa7</a> -4f0c-b62b-2fa7a32f369e&displaylang=en
Microsoft Security Update for Windows XP (KB941569)
Windows XP Service Pack 2
<a href=“http://www.microsoft.com/downloads/details.aspx?FamilyID=bece702a-6e61” target=“_blank”>http://www.microsoft.com/downloads/details.aspx?FamilyID=bece702a-6e61</a> -433e-8275-20f4e84f2c92&displaylang=en
Microsoft Windows Media Format 9.5 x64
Microsoft Security Update for Windows Media Format 11 Series for Windows XP x64 Edition (KB941569)
Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2
<a href=“http://www.microsoft.com/downloads/details.aspx?FamilyID=1037b224-ac89” target=“_blank”>http://www.microsoft.com/downloads/details.aspx?FamilyID=1037b224-ac89</a> -4efd-b189-6f3da77a88e6&displaylang=en
Microsoft Security Update for Windows Media Format 9.5 Series x64 Edition (KB941569)
Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2
<a href=“http://www.microsoft.com/downloads/details.aspx?FamilyID=72d2ca0e-da81” target=“_blank”>http://www.microsoft.com/downloads/details.aspx?FamilyID=72d2ca0e-da81</a> -45ee-9321-4970b80f4a5a&displaylang=en
Microsoft Windows Media Services 9.1 x64
Microsoft Security Update for Windows Server 2003 x64 Edition (KB944275)
Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2
<a href=“http://www.microsoft.com/downloads/details.aspx?FamilyID=23c23800-5aaa” target=“_blank”>http://www.microsoft.com/downloads/details.aspx?FamilyID=23c23800-5aaa</a> -455b-96bf-4ead4dfdd95d&displaylang=en
Microsoft Windows Media Format 7.1
Microsoft Security Update for Windows 2000 (KB941569)
Microsoft Windows 2000 Service Pack 4
<a href=“http://www.microsoft.com/downloads/details.aspx?FamilyID=eecdf2ce-9aa7” target=“_blank”>http://www.microsoft.com/downloads/details.aspx?FamilyID=eecdf2ce-9aa7</a> -4f0c-b62b-2fa7a32f369e&displaylang=en
Microsoft Windows Media Format 9.5
Microsoft Security Update for Windows Server 2003 (KB941569)
Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2
<a href=“http://www.microsoft.com/downloads/details.aspx?FamilyID=8fea7da8-a7f3” target=“_blank”>http://www.microsoft.com/downloads/details.aspx?FamilyID=8fea7da8-a7f3</a> -4786-97c2-fb5ea7018159&displaylang=en
Microsoft Security Update for Windows Server 2003 x64 Edition (KB941569)
Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2
<a href=“http://www.microsoft.com/downloads/details.aspx?FamilyID=ffc69c76-02f1” target=“_blank”>http://www.microsoft.com/downloads/details.aspx?FamilyID=ffc69c76-02f1</a> -4b15-8ec1-dab8c7e33bd4&displaylang=en
Microsoft Security Update for Windows XP (KB941569)
Windows XP Service Pack 2
<a href=“http://www.microsoft.com/downloads/details.aspx?FamilyID=bece702a-6e61” target=“_blank”>http://www.microsoft.com/downloads/details.aspx?FamilyID=bece702a-6e61</a> -433e-8275-20f4e84f2c92&displaylang=en
Microsoft Security Update for Windows XP x64 Edition (KB941569)
Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2
<a href=“http://www.microsoft.com/downloads/details.aspx?FamilyID=81f20b45-dfc7” target=“_blank”>http://www.microsoft.com/downloads/details.aspx?FamilyID=81f20b45-dfc7</a> -4ddf-a4b4-6c0e9476ed51&displaylang=en