Microsoft Windows Movie Maker and Producer '.mswmm' Buffer Overflow Vulnerability

Bugtraq ID:	38515
Class:	Boundary Condition Error
CVE:	CVE-2010-0265
Remote:	Yes
Local:	No
Published:	Mar 09 2010 12:00AM
Updated:	Sep 06 2010 06:22AM
Credit:	Damián Frizza of Core Security Technologies
Vulnerable:	Microsoft Producer 2003 0 Microsoft Movie Maker 6.0 Microsoft Movie Maker 2.6 + Microsoft Windows Vista Ultimate SP1 + Microsoft Windows Vista Ultimate SP1 + Microsoft Windows Vista SP2 + Microsoft Windows Vista SP2 + Microsoft Windows Vista SP1 + Microsoft Windows Vista SP1 + Microsoft Windows Vista Home Premium SP2 + Microsoft Windows Vista Home Premium SP2 + Microsoft Windows Vista Home Premium SP1 + Microsoft Windows Vista Home Premium SP1 + Microsoft Windows Vista Home Premium + Microsoft Windows Vista Home Premium + Microsoft Windows Vista Home Basic SP2 + Microsoft Windows Vista Home Basic SP2 + Microsoft Windows Vista Home Basic SP1 + Microsoft Windows Vista Home Basic SP1 + Microsoft Windows Vista Home Basic + Microsoft Windows Vista Home Basic + Microsoft Windows Vista Enterprise SP2 + Microsoft Windows Vista Enterprise SP2 + Microsoft Windows Vista Enterprise SP1 + Microsoft Windows Vista Enterprise SP1 + Microsoft Windows Vista Enterprise + Microsoft Windows Vista Enterprise + Microsoft Windows Vista Business SP2 + Microsoft Windows Vista Business SP2 + Microsoft Windows Vista Business SP1 + Microsoft Windows Vista Business SP1 + Microsoft Windows Vista Business + Microsoft Windows Vista Business + Microsoft Windows Vista Business 64-bit edition SP2 + Microsoft Windows Vista Business 64-bit edition SP2 + Microsoft Windows Vista Business 64-bit edition SP1 + Microsoft Windows Vista Business 64-bit edition SP1 + Microsoft Windows Vista Business 64-bit edition 0 + Microsoft Windows Vista Business 64-bit edition 0 + Microsoft Windows Vista Enterprise 64-bit edition SP2 + Microsoft Windows Vista Enterprise 64-bit edition SP2 + Microsoft Windows Vista Enterprise 64-bit edition SP1 + Microsoft Windows Vista Enterprise 64-bit edition SP1 + Microsoft Windows Vista Enterprise 64-bit edition 0 + Microsoft Windows Vista Enterprise 64-bit edition 0 + Microsoft Windows Vista Home Basic 64-bit edition SP2 + Microsoft Windows Vista Home Basic 64-bit edition SP2 + Microsoft Windows Vista Home Basic 64-bit edition SP1 + Microsoft Windows Vista Home Basic 64-bit edition SP1 + Microsoft Windows Vista Home Basic 64-bit edition 0 + Microsoft Windows Vista Home Basic 64-bit edition 0 + Microsoft Windows Vista Home Premium 64-bit edition SP2 + Microsoft Windows Vista Home Premium 64-bit edition SP2 + Microsoft Windows Vista Home Premium 64-bit edition SP1 + Microsoft Windows Vista Home Premium 64-bit edition SP1 + Microsoft Windows Vista Home Premium 64-bit edition 0 + Microsoft Windows Vista Home Premium 64-bit edition 0 + Microsoft Windows Vista Ultimate 64-bit edition SP2 + Microsoft Windows Vista Ultimate 64-bit edition SP2 + Microsoft Windows Vista Ultimate 64-bit edition SP1 + Microsoft Windows Vista Ultimate 64-bit edition SP1 + Microsoft Windows Vista Ultimate 64-bit edition 0 + Microsoft Windows Vista Ultimate 64-bit edition 0 + Microsoft Windows Vista x64 Edition SP2 + Microsoft Windows Vista x64 Edition SP2 + Microsoft Windows Vista x64 Edition SP1 + Microsoft Windows Vista x64 Edition SP1 + Microsoft Windows Vista x64 Edition 0 + Microsoft Windows Vista x64 Edition 0 Microsoft Movie Maker 2.1 + Microsoft Windows XP 0 + Microsoft Windows XP 0 + Microsoft Windows XP Home SP3 + Microsoft Windows XP Home SP3 + Microsoft Windows XP Home SP2 + Microsoft Windows XP Home SP2 + Microsoft Windows XP Media Center Edition SP3 + Microsoft Windows XP Media Center Edition SP3 + Microsoft Windows XP Media Center Edition SP2 + Microsoft Windows XP Media Center Edition SP2 + Microsoft Windows XP Professional SP3 + Microsoft Windows XP Professional SP3 + Microsoft Windows XP Professional SP2 + Microsoft Windows XP Professional SP2 + Microsoft Windows XP Professional x64 Edition SP3 + Microsoft Windows XP Professional x64 Edition SP3 + Microsoft Windows XP Professional x64 Edition SP2 + Microsoft Windows XP Professional x64 Edition SP2 + Microsoft Windows XP Professional x64 Edition + Microsoft Windows XP Professional x64 Edition + Microsoft Windows XP Tablet PC Edition SP3 + Microsoft Windows XP Tablet PC Edition SP3 + Microsoft Windows XP Tablet PC Edition SP2 + Microsoft Windows XP Tablet PC Edition SP2
Not Vulnerable:

Microsoft Windows Movie Maker and Producer '.mswmm' Buffer Overflow Vulnerability

Microsoft Movie Maker and Producer are prone to a buffer-overflow vulnerability because the applications fail to perform adequate boundary checks on user-supplied data.

Successful exploits can allow attackers to execute arbitrary code with the privileges of the user running the applications. Failed exploit attempts will result in a denial-of-service condition.

Microsoft Windows Movie Maker and Producer '.mswmm' Buffer Overflow Vulnerability

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

The following exploit is available:

• /data/vulnerabilities/exploits/38515.py

Microsoft Windows Movie Maker and Producer '.mswmm' Buffer Overflow Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.


Microsoft Movie Maker 2.1

• Microsoft Security Update for Windows XP (KB975561)
  http://www.microsoft.com/downloads/details.aspx?familyid=6301E462-02BE -4B9A-BAE9-7C4821B42D2D


• Microsoft Security Update for Windows XP x64 Edition (KB975561)
  http://www.microsoft.com/downloads/details.aspx?familyid=CAE81585-D0DF -41B8-9277-CA02F1265056

Microsoft Movie Maker 2.6

• Microsoft Security Update for Movie Maker 2.6 for Windows Vista (KB975561)
  http://www.microsoft.com/downloads/details.aspx?familyid=CA2D1118-CA64 -419D-86AF-9396E61B90B0


• Microsoft Security Update for Movie Maker 2.6 for Windows Vista for x64-based Systems (KB975561)
  http://www.microsoft.com/downloads/details.aspx?familyid=6A1F4126-97F2 -4AEE-BFE1-05BD13A0667B


• Microsoft Security Update for Windows 7 (KB975561)
  http://www.microsoft.com/downloads/details.aspx?familyid=822254EB-2EA6 -47A5-B5F8-45EF8EE53447


• Microsoft Security Update for Windows 7 for x64-based Systems (KB975561)
  http://www.microsoft.com/downloads/details.aspx?familyid=0FBF3063-1C2D -408C-A7B5-0C5857593C6F

Microsoft Movie Maker 6.0

• Microsoft Security Update for Movie Maker 6.0 for Windows Vista (KB975561)
  http://www.microsoft.com/downloads/details.aspx?familyid=AE2E9B75-1616 -4FE3-91BB-E2E28252FF1C


• Microsoft Security Update for Movie Maker 6.0 for Windows Vista for x64-based Systems (KB975561)
  http://www.microsoft.com/downloads/details.aspx?familyid=E27F353E-DEB6 -4D61-8808-C751D20A42A1

Microsoft Producer 2003 0

• Microsoft Producer for PowerPoint
  http://www.microsoft.com/downloads/details.aspx?familyid=1b3c76d5-fc75 -4f99-94bc-784919468e73&displaylang=en

Microsoft Windows Movie Maker and Producer '.mswmm' Buffer Overflow Vulnerability

References:

• Microsoft Homepage (Microsoft)
  
• Microsoft Knowledge Base Article 975561 (Microsoft)
  
• Update on MS10-016 for Microsoft Producer (Microsoft Security Response Center)
  
• Windows Movie Maker and Microsoft Producer IsValidWMToolsStream() Heap Overflow (Core Security Technologies)
  
• Microsoft Security Bulletin MS10-016 (Microsoft)