Hackers targeting unpatched Microsoft DirectShow flaw

Software giant is investigating a newly discovered flaw in DirectShow's QuickTime parser that could allow an attacker to execute code remotely

Microsoft released a security advisory Thursday warning of a new vulnerability in its DirectShow media-streaming architecture for Windows that could allow an attacker to execute code remotely.

The flaw, which Microsoft said is being actively exploited in limited attacks, affects Windows XP, Windows 2000, and Windows Server 2003. Windows Vista and Windows Server 2008 are not affected.

The vulnerability is in the QuickTime parser in DirectShow, according to Microsoft's Security Response Center.

"An attacker would try and exploit the vulnerability by crafting a specially formed video file and then posting it on a website or sending it as an attachment in email," Christopher Budd, security program manager at MSRC, wrote in a blog post.

While the flaw isn't a browser vulnerability, "a browser-based vector is potentially accessible through any browser using media plug-ins that use DirectShow," he said. Also, it's possible to direct calls to DirectShow even if Apple's QuickTime is installed, he added.

An attacker who successfully exploits the vulnerability could gain the same user rights as the local user, according to Microsoft.

Microsoft posted workarounds in its advisory. More details on the workarounds are available from Microsoft's Security Research and Defense blog.

This Content Component encountered an error

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

-ADS BY GOOGLE

SearchCloudSecurity

SearchNetworking

SearchCIO

SearchConsumerization

SearchEnterpriseDesktop

SearchCloudComputing

ComputerWeekly

Close