Microsoft DirectShow CVE-2013-3174 Remote Code Execution Vulnerability

Bugtraq ID:	60979
Class:	Unknown
CVE:	CVE-2013-3174
Remote:	Yes
Local:	No
Published:	Jul 09 2013 12:00AM
Updated:	Mar 19 2015 08:50AM
Credit:	Andrés Gómez Ramírez
Vulnerable:	Microsoft Windows XP Service Pack 3 0 Microsoft Windows XP Professional x64 Edition SP2 Microsoft Windows Vista Service Pack 2 0 Microsoft Windows Server 2008 R2 for x64-based Systems SP1 Microsoft Windows Server 2008 for x64-based Systems SP2 Microsoft Windows Server 2008 for 32-bit Systems SP2 Microsoft Windows Server 2003 x64 SP2 Microsoft Windows Server 2003 Itanium SP2 Microsoft Windows Server 2003 SP2 Microsoft Windows 7 for x64-based Systems SP1 Microsoft Windows 7 for 32-bit Systems SP1 Avaya Messaging Application Server 5.2 Avaya Messaging Application Server 5 Avaya Messaging Application Server 4 Avaya Meeting Exchange - Webportal 0 Avaya Conferencing Standard Edition 6.0 SP1 Avaya Conferencing Standard Edition 6.0 Avaya Communication Server 1000 Telephony Manager 4.0 Avaya Communication Server 1000 Telephony Manager 3.0 Avaya CallPilot 5.0 Avaya CallPilot 4.0
Not Vulnerable:

Microsoft DirectShow CVE-2013-3174 Remote Code Execution Vulnerability

Microsoft DirectShow is prone to a remote code-execution vulnerability.

Successful exploits allow remote attackers to execute arbitrary code in the context of the user running an application that uses DirectShow. Failed exploit attempts will result in a denial-of-service condition.

Microsoft DirectShow CVE-2013-3174 Remote Code Execution Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft DirectShow CVE-2013-3174 Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.


Microsoft Windows 8 for 32-bit Systems 0

• Microsoft Security Update for Windows 8 (KB2845187)
  http://www.microsoft.com/downloads/details.aspx?familyid=f2e2512d-4248 -4e4a-a4a0-d43048cc24c5

Microsoft Windows 7 for 32-bit Systems SP1

• Microsoft Security Update for Windows 7 (KB2845187)
  http://www.microsoft.com/downloads/details.aspx?familyid=4ed7735f-1414 -4083-bf59-0117ec374f6b

Microsoft Windows 7 for x64-based Systems SP1

• Microsoft Security Update for Windows 7 for x64-based Systems (KB2845187)
  http://www.microsoft.com/downloads/details.aspx?familyid=cb67b2c1-2bcf -4cda-9ad9-92228e3d5e6a

Microsoft Windows Server 2008 for 32-bit Systems SP2

• Microsoft Security Update for Windows Server 2008 (KB2845187)
  http://www.microsoft.com/downloads/details.aspx?familyid=e2b7cb01-0edd -4401-a526-275a585e9cda

Microsoft Windows Server 2003 SP2

• Microsoft Security Update for Windows Server 2003 (KB2845187)
  http://www.microsoft.com/downloads/details.aspx?familyid=4465b979-0d35 -4d5c-9037-dc48e9ca2f7a

Microsoft Windows Server 2008 for x64-based Systems SP2

• Microsoft Security Update for Windows Server 2008 x64 Edition (KB2845187)
  http://www.microsoft.com/downloads/details.aspx?familyid=6866299f-215e -448c-b5f5-a2246563be01

Microsoft Windows Server 2003 Itanium SP2

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB2845187)
  http://www.microsoft.com/downloads/details.aspx?familyid=b654732f-dae1 -49d7-9947-ac2f6a2f4093

Microsoft Windows Server 2008 R2 for x64-based Systems SP1

• Microsoft Security Update for Windows Server 2008 R2 x64 Edition (KB2845187)
  http://www.microsoft.com/downloads/details.aspx?familyid=d5ab043f-d5a9 -4164-a82e-0bca44db66b6

Microsoft Windows XP Professional x64 Edition SP2

• Microsoft Security Update for Windows XP x64 Edition (KB2845187)
  http://www.microsoft.com/downloads/details.aspx?familyid=b1c9bcff-1700 -4e4d-aab1-b78deca572f3

Microsoft Windows Server 2003 x64 SP2

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB2845187)
  http://www.microsoft.com/downloads/details.aspx?familyid=6d140893-ba9a -4eec-8d97-4421621748ec

Microsoft Windows 8 for 64-bit Systems 0

• Microsoft Security Update for Windows 8 for x64-based Systems (KB2845187)
  http://www.microsoft.com/downloads/details.aspx?familyid=e37619eb-f8a3 -4f63-b037-e1d4600cfab5

Microsoft DirectShow CVE-2013-3174 Remote Code Execution Vulnerability

References:

• DirectShow Arbitrary Memory Overwrite Vulnerability ms13-056 (Andrés Gómez Ramírez)
  
• Microsoft DirectX Homepage (Microsoft)
  
• Microsoft Homepage (Microsoft)
  
• Microsoft Security Bulletin MS13-056 (Microsoft)
  
• MS13-056 Vulnerability in Microsoft DirectShow Could Allow Remote Code Execution (Avaya)