Windows Media Player Network Sharing Service RTSP Use After Free Remote Code Execution Vulnerability

Bugtraq ID:	43776
Class:	Boundary Condition Error
CVE:	CVE-2010-3225
Remote:	Yes
Local:	No
Published:	Oct 12 2010 12:00AM
Updated:	Oct 12 2010 12:00AM
Credit:	Oleksandr Mirosh, working with TippingPoint's Zero Day Initiative
Vulnerable:	Microsoft Windows Vista x64 Edition SP2 Microsoft Windows Vista x64 Edition SP1 Microsoft Windows Vista Ultimate 64-bit edition SP2 Microsoft Windows Vista Ultimate 64-bit edition SP1 Microsoft Windows Vista Home Premium 64-bit edition SP2 Microsoft Windows Vista Home Premium 64-bit edition SP1 Microsoft Windows Vista Home Basic 64-bit edition SP2 Microsoft Windows Vista Home Basic 64-bit edition SP1 Microsoft Windows Vista Enterprise 64-bit edition SP2 Microsoft Windows Vista Enterprise 64-bit edition SP1 Microsoft Windows Vista Business 64-bit edition SP2 Microsoft Windows Vista Business 64-bit edition SP1 Microsoft Windows Vista Ultimate SP2 Microsoft Windows Vista Ultimate SP1 Microsoft Windows Vista SP2 Microsoft Windows Vista SP1 Microsoft Windows Vista Home Premium SP2 Microsoft Windows Vista Home Premium SP1 Microsoft Windows Vista Home Basic SP2 Microsoft Windows Vista Home Basic SP1 Microsoft Windows Vista Enterprise SP2 Microsoft Windows Vista Enterprise SP1 Microsoft Windows Vista Business SP2 Microsoft Windows Vista Business SP1 Microsoft Windows 7 XP Mode 0 Microsoft Windows 7 Ultimate 0 Microsoft Windows 7 Starter 0 Microsoft Windows 7 Professional 0 Microsoft Windows 7 Home Premium 0 Microsoft Windows 7 for x64-based Systems 0 Microsoft Windows 7 for 32-bit Systems 0
Not Vulnerable:

Windows Media Player Network Sharing Service RTSP Use After Free Remote Code Execution Vulnerability

The Microsoft Windows Media Player Network Sharing Service is prone to a remote code-execution vulnerability.

Attackers can exploit this issue to execute arbitrary code in context of the NetworkService account. Failed exploit attempts will likely result in denial-of-service conditions.

Windows Media Player Network Sharing Service RTSP Use After Free Remote Code Execution Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Windows Media Player Network Sharing Service RTSP Use After Free Remote Code Execution Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.


Microsoft Windows Vista SP1

• Microsoft Windows6.0-KB2281679-x86.msu
  http://www.microsoft.com/downloads/details.aspx?familyid=4A481825-D9AD -4A7C-AA89-F40FB9651961

Microsoft Windows Vista SP2

• Microsoft Windows6.0-KB2281679-x86.msu
  http://www.microsoft.com/downloads/details.aspx?familyid=4A481825-D9AD -4A7C-AA89-F40FB9651961

Microsoft Windows 7 for 32-bit Systems 0

• Microsoft Windows6.1-KB2281679-x86.msu
  http://www.microsoft.com/downloads/details.aspx?familyid=1A3953FE-BA48 -4980-A65D-74E3B756D53C

Microsoft Windows Vista x64 Edition SP2

• Microsoft Windows6.0-KB2281679-x64.msu
  http://www.microsoft.com/downloads/details.aspx?familyid=15D8F81B-97B0 -43D9-B218-1CDD759CB2EC

Microsoft Windows 7 for x64-based Systems 0

• Microsoft Windows6.1-KB2281679-x64.msu
  http://www.microsoft.com/downloads/details.aspx?familyid=5759D2A3-7F35 -4FA1-8AB4-17145839FA26

Microsoft Windows Vista x64 Edition SP1

• Microsoft Windows6.0-KB2281679-x64.msu
  http://www.microsoft.com/downloads/details.aspx?familyid=15D8F81B-97B0 -43D9-B218-1CDD759CB2EC

Windows Media Player Network Sharing Service RTSP Use After Free Remote Code Execution Vulnerability

References:

• Microsoft Homepage (Microsoft)
  
• Microsoft Security Bulletin MS10-075 (Microsoft)