Microsoft Windows Media Center DLL Loading Arbitrary Code Execution Vulnerability

Bugtraq ID:	49943
Class:	Design Error
CVE:	CVE-2011-2009
Remote:	Yes
Local:	No
Published:	Oct 11 2011 12:00AM
Updated:	Oct 11 2011 12:00AM
Credit:	Vendor
Vulnerable:	Microsoft Windows Vista x64 Edition SP2 Microsoft Windows Vista x64 Edition SP1 Microsoft Windows Vista x64 Edition 0 Microsoft Windows Vista Ultimate SP2 Microsoft Windows Vista Ultimate SP1 Microsoft Windows Vista SP2 Microsoft Windows Vista SP1 Microsoft Windows Vista Home Premium SP2 Microsoft Windows Vista Home Premium SP1 Microsoft Windows Vista Home Basic SP2 Microsoft Windows Vista Home Basic SP1 Microsoft Windows Vista Enterprise SP2 Microsoft Windows Vista Enterprise SP1 Microsoft Windows Vista Business SP2 Microsoft Windows Vista Business SP1 Microsoft Windows Media Center TV Pack for Windows Vista 64-bit edition 0 Microsoft Windows Media Center TV Pack for Windows Vista 32-bit edition 0 Microsoft Windows 7 for x64-based Systems SP1 Microsoft Windows 7 for x64-based Systems 0 Microsoft Windows 7 for 32-bit Systems SP1 Microsoft Windows 7 for 32-bit Systems 0
Not Vulnerable:

Microsoft Windows Media Center DLL Loading Arbitrary Code Execution Vulnerability

Microsoft Windows is prone to an arbitrary-code-execution vulnerability that affects the Media Center.

Attackers can exploit this vulnerability to execute arbitrary code in the context of the user running the vulnerable application.

Microsoft Windows Media Center DLL Loading Arbitrary Code Execution Vulnerability

To exploit this issue, attackers must trick a user into opening a file on a remote WebDAV or SMB share.

A general exploit technique has been documented by TheLeader and H.D. Moore for the Metasploit Project; please see the references for more information.

Microsoft Windows Media Center DLL Loading Arbitrary Code Execution Vulnerability

References:

• Application DLL Load Hijacking (HD Moore)
  
• Exploiting DLL Hijacking Flaws (hdm)
  
• Microsoft Homepage (Microsoft)
  
• Microsoft Security Advisory 2269637 Released (Microsoft)
  
• More information about the DLL Preloading remote attack vector (Microsoft)
  
• Microsoft Security Advisory (2269637) (Microsoft)
  
• Microsoft Security Bulletin MS11-076 (Microsoft)