Severity: High
11 December, 2007
Summary:
Today, Microsoft released two security bulletins describing vulnerabilities that affect components Windows uses to handle multimedia (specifically, DirectX and the Windows Media File Format Runtime). A remote attacker could exploit the flaws in these components to execute code on your Windows PC, potentially gaining complete control of it. If you manage a Windows network, you should download, test, and deploy the appropriate patches throughout your network as soon as possible.
Exposure:
Microsoft’s security bulletins detail vulnerabilities found in two Windows components used to handle multimedia. We summarize these vulnerabilities below:
MS07-064: Two Remote Code Execution Vulnerabilities in DirectX
Severity: High
11 December, 2007
Summary:
Today, Microsoft released two security bulletins describing vulnerabilities that affect components Windows uses to handle multimedia (specifically, DirectX and the Windows Media File Format Runtime). A remote attacker could exploit the flaws in these components to execute code on your Windows PC, potentially gaining complete control of it. If you manage a Windows network, you should download, test, and deploy the appropriate patches throughout your network as soon as possible.
Exposure:
Microsoft’s security bulletins detail vulnerabilities found in two Windows components used to handle multimedia. We summarize these vulnerabilities below:
MS07-064: Two Remote Code Execution Vulnerabilities in DirectX
DirectX is a multimedia-handling component that ships with all current versions of Windows. According to Microsoft, DirectX suffers from a couple of remote code execution vulnerabilities because it improperly parses certain multimedia files. The vulnerabilities differ technically, but share the same scope and impact. By enticing one of your users into opening a malicious media file, an attacker can exploit these vulnerabilities to execute code on your user’s computer, with your user’s privileges. If your user has local administrative privileges, the attacker gains complete control of your user’s machine. The only difference of note between these flaws involves which media file the attacker can use to exploit them. The potentially dangerous files that could trigger these flaws are:
- AVI Video files (.avi)
- WAV sound files (.wav)
- SAMI files (.sami or .smi)
Microsoft rating: Critical.
MS07-068: Windows Media File Format Runtime Code Execution Vulnerability
The Windows Media File Format Runtime is a component Windows uses to play various Windows Media file types, such as WMV or WMA. The Windows Media File Format Runtime suffers from a vulnerability due to its inability to properly parse Advanced System Format (ASF) streaming media. By enticing one of your users into opening a specially crafted ASF file, or enticing them to a web site that contains an ASF stream, an attacker could exploit this vulnerability to execute code on your user’s computer, with your user’s privileges. As usual, if your user has local administrative privileges, attackers could leverage this flaw to take over your user’s computer.
Microsoft rating: Critical.
Solution Path
Microsoft has released patches for DirectX and Windows Media File Format Runtime to correct these vulnerabilities. You should download, test, and deploy the appropriate patches throughout your network immediately.
- DirectX 7.0 (for 2000)
- DirectX 8.1 (for 2000)
- Direct X 9.0c
- DirectX 10.0
- Windows Media File Format Runtime 7.1
- Windows Media File Format Runtime 9
- Windows Media File Format Runtime 9.5
- Windows Media File Format Runtime 9.5 x64 Edition
- Windows Media File Format Runtime 11
- Windows Media Services Runtime 9.1
For All WatchGuard Users:
You can mitigate the risk of these vulnerabilities by configuring your WatchGuard Firebox to block the following file types using its SMTP and HTTP proxies:
- .avi
- .wav
- .smi
- .sami
- .asf
Keep in mind, blocking these file types will prevent your users from downloading them, whether the files are legitimate or malicious. Some organizations prefer to allow these media files into their network. Whether you decide to block these file types or not, applying Microsoft’s patches is the best solution
If you want to block these media files using your Firebox’s SMTP and HTTP proxies, refer to the links below:
- Firebox X Edge running 8.5 or later
- Firebox III and X Core running WFS
- Firebox X Core and X Peak running Fireware Pro
Status:
Microsoft has released patches correcting these issues.
References:
- Microsoft Security Bulletin MS07-064
Microsoft Security Bulletin MS07-068