Microsoft MPEG Layer-3 Audio Decoder Buffer Overflow Vulnerability

Bugtraq ID:	42298
Class:	Unknown
CVE:	CVE-2010-1882
Remote:	Yes
Local:	No
Published:	Aug 10 2010 12:00AM
Updated:	Sep 16 2010 03:51PM
Credit:	Moritz Jodeit of n.runs AG
Vulnerable:	Microsoft Windows XP Tablet PC Edition SP3 Microsoft Windows XP Tablet PC Edition SP2 Microsoft Windows XP Tablet PC Edition SP1 Microsoft Windows XP Tablet PC Edition Microsoft Windows XP Professional x64 Edition SP2 Microsoft Windows XP Professional x64 Edition Microsoft Windows XP Professional SP3 Microsoft Windows XP Professional SP2 Microsoft Windows XP Professional SP1 Microsoft Windows XP Professional Microsoft Windows XP Media Center Edition SP3 Microsoft Windows XP Media Center Edition SP2 Microsoft Windows XP Media Center Edition SP1 Microsoft Windows XP Media Center Edition Microsoft Windows XP Home SP3 Microsoft Windows XP Home SP2 Microsoft Windows XP Home SP1 Microsoft Windows XP Home Microsoft Windows Server 2003 x64 SP2 Microsoft Windows Server 2003 x64 SP1 Microsoft Windows Server 2003 Web Edition SP2 Microsoft Windows Server 2003 Web Edition SP1 Microsoft Windows Server 2003 Web Edition Microsoft Windows Server 2003 Enterprise x64 Edition SP2 Microsoft Windows Server 2003 Enterprise x64 Edition Microsoft Windows Server 2003 Enterprise Edition SP1 Microsoft Windows Server 2003 Enterprise Edition Microsoft Windows Server 2003 Datacenter x64 Edition SP2 Microsoft Windows Server 2003 Datacenter x64 Edition Microsoft Windows Server 2003 Datacenter Edition Microsoft Windows Server 2003 Sp2 Storage Microsoft Windows Server 2003 Sp2 Enterprise Microsoft Windows Server 2003 Sp2 Datacenter Microsoft Windows Server 2003 Sp2 Compute Cluster Microsoft Windows Server 2003 Sp1 Storage Microsoft Windows Server 2003 SP1 Platform SDK Microsoft Windows Server 2003 Sp1 Compute Cluster Microsoft Windows Server 2003 SP1 Avaya Messaging Application Server MM 3.1 Avaya Messaging Application Server MM 3.0 Avaya Messaging Application Server MM 2.0 Avaya Messaging Application Server MM 1.1 Avaya Messaging Application Server 5 Avaya Messaging Application Server 4 Avaya Messaging Application Server 0 Avaya Meeting Exchange - Webportal 6.0 Avaya Meeting Exchange - Web Conferencing Server 0 Avaya Meeting Exchange - Streaming Server 0 Avaya Meeting Exchange - Recording Server 0 Avaya Meeting Exchange - Client Registration Server 0 Avaya CallPilot Unified Messaging 0 Avaya Aura Conferencing 6.0 Standard
Not Vulnerable:

Microsoft MPEG Layer-3 Audio Decoder Buffer Overflow Vulnerability

Microsoft MPEG Layer-3 audio decoder is prone to a remote buffer-overflow vulnerability because the applicaiton fails to perform adequate boundary-checks on user-supplied data.

Successful exploits allow remote attackers to execute arbitrary code in the context of the user running the application. Failed exploit attempts will result in a denial-of-service condition.

Microsoft MPEG Layer-3 Audio Decoder Buffer Overflow Vulnerability

A commercial proof of concept is available through VUPEN Security - Exploit and PoCs Service. This proof of concept is not otherwise publicly available or known to be circulating in the wild.

Microsoft MPEG Layer-3 Audio Decoder Buffer Overflow Vulnerability

References:

• Microsoft Homepage (Microsoft)
  
• ZDI-10-147: Microsoft Windows MPEG Layer-3 Audio Decoder Remote Code Execution (ZDI Disclosures )
  
• ASA-2010-243 MS10-062 Vulnerability in MPEG-4 Codec Could Allow Remote Code Exec (Avaya)
  
• Microsoft Security Bulletin MS10-052 (Microsoft)