Microsoft Windows Malformed AVI File Parsing Remote Integer Overflow Vulnerability

Bugtraq ID:	35970
Class:	Boundary Condition Error
CVE:	CVE-2009-1546
Remote:	Yes
Local:	No
Published:	Aug 11 2009 12:00AM
Updated:	Oct 08 2009 03:49PM
Credit:	Vinay Anantharaman
Vulnerable:	Nortel Networks Symposium Agent Nortel Networks Self-Service WVADS 0 Nortel Networks Self-Service VoiceXML 0 Nortel Networks Self-Service Speech Server 0 Nortel Networks Self-Service Peri Workstation 0 Nortel Networks Self-Service Peri NT Server 0 Nortel Networks Self-Service Peri Application 0 Nortel Networks Self-Service MPS 500 0 Nortel Networks Self-Service MPS 1000 0 Nortel Networks Self-Service MPS 100 0 Nortel Networks Self-Service CCXML 0 Nortel Networks Self-Service - CCSS7 0 Nortel Networks Media Processing Svr 500 Rel 3.0 Nortel Networks Media Processing Svr 1000 Rel 3.0 Nortel Networks Media Processing Svr 100 0 Nortel Networks Contact Center NCC 0 Nortel Networks Contact Center Manager Server 0 Nortel Networks Contact Center Express Nortel Networks Contact Center Administration 0 Nortel Networks Contact Center - TAPI Server 0 Nortel Networks CallPilot 702t Nortel Networks CallPilot 600r Nortel Networks CallPilot 202i Nortel Networks CallPilot 201i Nortel Networks CallPilot 1005r Nortel Networks CallPilot 1002rp Microsoft Windows XP Tablet PC Edition SP3 Microsoft Windows XP Tablet PC Edition SP2 Microsoft Windows XP Professional x64 Edition SP2 Microsoft Windows XP Professional SP3 Microsoft Windows XP Professional SP2 Microsoft Windows XP Media Center Edition SP3 Microsoft Windows XP Media Center Edition SP2 Microsoft Windows XP Home SP3 Microsoft Windows XP Home SP2 Microsoft Windows Vista x64 Edition SP2 Microsoft Windows Vista x64 Edition SP1 Microsoft Windows Vista x64 Edition 0 Microsoft Windows Vista Ultimate SP2 Microsoft Windows Vista Ultimate SP1 Microsoft Windows Vista Ultimate Microsoft Windows Vista Home Premium SP2 Microsoft Windows Vista Home Premium SP1 Microsoft Windows Vista Home Premium Microsoft Windows Vista Home Basic SP2 Microsoft Windows Vista Home Basic SP1 Microsoft Windows Vista Home Basic Microsoft Windows Vista Enterprise SP2 Microsoft Windows Vista Enterprise SP1 Microsoft Windows Vista Enterprise Microsoft Windows Vista Business SP2 Microsoft Windows Vista Business SP1 Microsoft Windows Vista Business Microsoft Windows Server 2008 for x64-based Systems SP2 Microsoft Windows Server 2008 for x64-based Systems 0 Microsoft Windows Server 2008 for Itanium-based Systems SP2 Microsoft Windows Server 2008 for Itanium-based Systems 0 Microsoft Windows Server 2008 for 32-bit Systems SP2 Microsoft Windows Server 2008 for 32-bit Systems 0 Microsoft Windows Server 2003 x64 SP2 Microsoft Windows Server 2003 Itanium SP2 Microsoft Windows Server 2003 SP2 Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Professional SP4 Microsoft Windows 2000 Datacenter Server SP4 Microsoft Windows 2000 Advanced Server SP4
Not Vulnerable:

Microsoft Windows Malformed AVI File Parsing Remote Integer Overflow Vulnerability

Microsoft Windows is prone to a remote integer-overflow vulnerability that arises when an affected Windows component handles a malicious Audio Video Interleave (AVI) file.

An attacker can exploit this issue to execute arbitrary code with the privileges of the affected user. Failed exploit attempts will result in a denial-of-service condition.

NOTE: Since the affected Windows operating system component is independent of Windows Media Player, this issue does not specifically affect Windows Media Player.

Microsoft Windows Malformed AVI File Parsing Remote Integer Overflow Vulnerability

A commercial proof of concept is available through VUPEN Security - Exploit and PoCs Service. This proof of concept is not otherwise publicly available or known to be circulating in the wild.

Microsoft Windows Malformed AVI File Parsing Remote Integer Overflow Vulnerability

Solution:
The vendor has released updates and an advisory. Please see the references for details.


Microsoft Windows XP Media Center Edition SP2

• Microsoft Security Update for Windows XP (KB971557)
  http://www.microsoft.com/downloads/details.aspx?familyid=2e8a68ee-eb24 -424c-b084-450636ccaeec

Microsoft Windows Server 2008 for 32-bit Systems SP2

• Microsoft Security Update for Windows Server 2008 (KB971557)
  http://www.microsoft.com/downloads/details.aspx?familyid=fdc96a07-ed79 -4798-8077-b2e9ca64cd0f

Microsoft Windows Vista x64 Edition 0

• Microsoft Security Update for Windows Vista for x64-based Systems (KB971557)
  http://www.microsoft.com/downloads/details.aspx?familyid=a6cea61a-4ad9 -4e18-bf18-348ae4ae51c4

Microsoft Windows XP Tablet PC Edition SP2

• Microsoft Security Update for Windows XP (KB971557)
  http://www.microsoft.com/downloads/details.aspx?familyid=2e8a68ee-eb24 -424c-b084-450636ccaeec

Microsoft Windows XP Media Center Edition SP3

• Microsoft Security Update for Windows XP (KB971557)
  http://www.microsoft.com/downloads/details.aspx?familyid=2e8a68ee-eb24 -424c-b084-450636ccaeec

Microsoft Windows XP Professional x64 Edition SP2

• Microsoft Security Update for Windows XP x64 Edition (KB971557)
  http://www.microsoft.com/downloads/details.aspx?familyid=a1ff2ace-b9dc -4cf3-a151-ac6959bcb3a6

Microsoft Windows Server 2003 x64 SP2

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB971557)
  http://www.microsoft.com/downloads/details.aspx?familyid=58a7c8d9-ec36 -46a6-a89b-d8dfd989fda4

Microsoft Windows Vista x64 Edition SP1

• Microsoft Security Update for Windows Vista for x64-based Systems (KB971557)
  http://www.microsoft.com/downloads/details.aspx?familyid=a6cea61a-4ad9 -4e18-bf18-348ae4ae51c4

Microsoft Windows XP Tablet PC Edition SP3

• Microsoft Security Update for Windows XP (KB971557)
  http://www.microsoft.com/downloads/details.aspx?familyid=2e8a68ee-eb24 -424c-b084-450636ccaeec

Microsoft Windows Server 2008 for x64-based Systems 0

• Microsoft Security Update for Windows Server 2008 x64 Edition (KB971557)
  http://www.microsoft.com/downloads/details.aspx?familyid=8e3afba4-6761 -4b3d-98bb-4b4145e27b7f

Microsoft Windows Server 2008 for Itanium-based Systems SP2

• Microsoft Security Update for Windows Server 2008 for Itanium-based Systems (KB971557)
  http://www.microsoft.com/downloads/details.aspx?familyid=aa1bb13a-5905 -48c4-8e74-a41104593046

Microsoft Windows 2000 Advanced Server SP4

• Microsoft Security Update for Windows 2000 (KB971557)
  http://www.microsoft.com/downloads/details.aspx?familyid=5f80bf0b-898c -46ca-b20c-21e0e729c332

Microsoft Windows Server 2003 SP2

• Microsoft Security Update for Windows Server 2003 (KB971557)
  http://www.microsoft.com/downloads/details.aspx?familyid=cba78658-899c -428f-8b04-cfe14ce3c255

Microsoft Windows XP Home SP2

• Microsoft Security Update for Windows XP (KB971557)
  http://www.microsoft.com/downloads/details.aspx?familyid=2e8a68ee-eb24 -424c-b084-450636ccaeec

Microsoft Windows Server 2008 for x64-based Systems SP2

• Microsoft Security Update for Windows Server 2008 x64 Edition (KB971557)
  http://www.microsoft.com/downloads/details.aspx?familyid=8e3afba4-6761 -4b3d-98bb-4b4145e27b7f

Microsoft Windows 2000 Datacenter Server SP4

• Microsoft Security Update for Windows 2000 (KB971557)
  http://www.microsoft.com/downloads/details.aspx?familyid=5f80bf0b-898c -46ca-b20c-21e0e729c332

Microsoft Windows Server 2003 Itanium SP2

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB971557)
  http://www.microsoft.com/downloads/details.aspx?familyid=187b02bd-73d6 -4f72-81d1-d9477d495499

Microsoft Windows XP Home SP3

• Microsoft Security Update for Windows XP (KB971557)
  http://www.microsoft.com/downloads/details.aspx?familyid=2e8a68ee-eb24 -424c-b084-450636ccaeec

Microsoft Windows Vista x64 Edition SP2

• Microsoft Security Update for Windows Vista for x64-based Systems (KB971557)
  http://www.microsoft.com/downloads/details.aspx?familyid=a6cea61a-4ad9 -4e18-bf18-348ae4ae51c4

Microsoft Windows Server 2008 for Itanium-based Systems 0

• Microsoft Security Update for Windows Server 2008 for Itanium-based Systems (KB971557)
  http://www.microsoft.com/downloads/details.aspx?familyid=aa1bb13a-5905 -48c4-8e74-a41104593046

Microsoft Windows XP Professional SP3

• Microsoft Security Update for Windows XP (KB971557)
  http://www.microsoft.com/downloads/details.aspx?familyid=2e8a68ee-eb24 -424c-b084-450636ccaeec

Microsoft Windows Server 2008 for 32-bit Systems 0

• Microsoft Security Update for Windows Server 2008 (KB971557)
  http://www.microsoft.com/downloads/details.aspx?familyid=fdc96a07-ed79 -4798-8077-b2e9ca64cd0f

Microsoft Windows XP Professional SP2

• Microsoft Security Update for Windows XP (KB971557)
  http://www.microsoft.com/downloads/details.aspx?familyid=2e8a68ee-eb24 -424c-b084-450636ccaeec

Microsoft Windows 2000 Server SP4

• Microsoft Security Update for Windows 2000 (KB971557)
  http://www.microsoft.com/downloads/details.aspx?familyid=5f80bf0b-898c -46ca-b20c-21e0e729c332

Microsoft Windows 2000 Professional SP4

• Microsoft Security Update for Windows 2000 (KB971557)
  http://www.microsoft.com/downloads/details.aspx?familyid=5f80bf0b-898c -46ca-b20c-21e0e729c332

Microsoft Windows Malformed AVI File Parsing Remote Integer Overflow Vulnerability

References:

• Microsoft Homepage (Microsoft)
  
• Nortel Response to Microsoft Security Bulletin MS09-039 (Nortel)
  
• Microsoft Security Bulletin MS09-038 (Microsoft)