Security Advisories
[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]
Subject: CERT Advisory CA-2003-18 Integer Overflows in Microsoft Windows DirectX MIDI Library
From: CERT Advisory <This email address is being protected from spambots. You need JavaScript enabled to view it.>
Date: Fri, 25 Jul 2003 14:49:29 -0400
-----BEGIN PGP SIGNED MESSAGE-----
CERT Advisory CA-2003-18 Integer Overflows in Microsoft Windows DirectX
MIDI Library
Original issue date: July 25, 2003
Last revised: --
Source: CERT/CC
A complete revision history is at the end of this file.
Systems Affected
* Microsoft Windows systems running DirectX (Windows 98, 98SE, NT
4.0, NT 4.0 TSE, 2000, Server 2003)
Overview
A set of integer overflows exists in a DirectX library included in
Microsoft Windows. An attacker could exploit this vulnerability to
execute arbitrary code or to cause a denial of service.
I. Description
Microsoft Windows operating systems include multimedia technologies
called DirectX and DirectShow. From Microsoft Security Bulletin
MS03-030, "DirectX consists of a set of low-level Application
Programming Interfaces (APIs) that are used by Windows programs for
multimedia support. Within DirectX, the DirectShow technology performs
client-side audio and video sourcing, manipulation, and rendering."
DirectShow support for MIDI files is implemented in a library called
quartz.dll. This library contains two vulnerabilities:
VU#561284 - Microsoft Windows DirectX MIDI library does not
adequately validate Text or Copyright parameters in
MIDI files
VU#265232 - Microsoft Windows DirectX MIDI library does not
adequately validate MThd track values in MIDI files
In both cases, a specially crafted MIDI file could cause an integer
overflow, leading to incorrect memory allocation and heap corruption.
Any application that uses DirectX/DirectShow to process MIDI files may
be affected by this vulnerability. Of particular concern, Internet
Explorer (IE) uses the Windows Media Player ActiveX control and
quartz.dll to handle MIDI files embedded in HTML documents. An
attacker could therefore exploit this vulnerability by convincing a
victim to view an HTML document, such as a web page or an HTML email
message, that contains an embedded MIDI file. Note that in addition to
IE, a number of applications, including Outlook, Outlook Express,
Eudora, AOL, Lotus Notes, and Adobe PhotoDeluxe, use the WebBrowser
ActiveX control to interpret HTML documents.
Further technical details are available in eEye Digital Security
advisory AD20030723. Common Vulnerabilities and Exposures (CVE) refers
to these vulnerabilities as CAN-2003-0346.
II. Impact
By convincing a victim to access a specially crafted MIDI or HTML
file, an attacker could execute arbitrary code with the privileges of
the victim. The attacker could also cause a denial of service in any
application that uses the vulnerable functions in quartz.dll.
III. Solution
Apply a patch
Apply the appropriate patch as specified by Microsoft Security
Bulletin MS03-030.
Disable embedded MIDI files
Change the Run ActiveX controls and plug-ins security setting to
Disable in the Internet zone and the zone(s) used by Outlook, Outlook
Express, and any other application that uses the WebBrowser ActiveX
control to render HTML. This modification will prevent MIDI files from
being automatically loaded from HTML documents. This workaround is not
a complete solution and will not prevent attacks that attempt to load
MIDI files directly.
Instructions for modifying IE security zone settings can be found in
the CERT/CC Malicious Web Scripts FAQ.
Appendix A. Vendor Information
This appendix contains information provided by vendors. When vendors
report new information, this section is updated and the changes are
noted in the revision history. If a vendor is not listed below, we
have not received their comments.
Microsoft
Please see Microsoft Security Bulletin MS03-030.
Appendix B. References
* CERT/CC Vulnerability Note VU#561284 -
http://www.kb.cert.org/vuls/id/561284
* CERT/CC Vulnerability Note VU#265232 -
http://www.kb.cert.org/vuls/id/265232
* eEye Digital Security advisory AD20030723 -
http://www.eeye.com/html/Research/Advisories/AD20030723.html
* Microsoft Security Bulletin MS03-030 -
http://microsoft.com/technet/security/bulletin/MS03-030.asp
* Microsoft Knowledge Base article 819696 -
http://support.microsoft.com/default.aspx?scid=kb;en-us;819696
_________________________________________________________________
These vulnerabilities were researched and reported by eEye Digital
Security.
_________________________________________________________________
Feedback can be directed to the author, Art Manion.
______________________________________________________________________
This document is available from:
http://www.cert.org/advisories/CA-2003-18.html
______________________________________________________________________
CERT/CC Contact Information
Email: This email address is being protected from spambots. You need JavaScript enabled to view it.
Phone: +1 412-268-7090 (24-hour hotline)
Fax: +1 412-268-6989
Postal address:
CERT Coordination Center
Software Engineering Institute
Carnegie Mellon University
Pittsburgh PA 15213-3890
U.S.A.
CERT/CC personnel answer the hotline 08:00-17:00 EST(GMT-5) /
EDT(GMT-4) Monday through Friday; they are on call for emergencies
during other hours, on U.S. holidays, and on weekends.
Using encryption
We strongly urge you to encrypt sensitive information sent by email.
Our public PGP key is available from
http://www.cert.org/CERT_PGP.key
If you prefer to use DES, please call the CERT hotline for more
information.
Getting security information
CERT publications and other security information are available from
our web site
http://www.cert.org/
To subscribe to the CERT mailing list for advisories and bulletins,
send email to This email address is being protected from spambots. You need JavaScript enabled to view it.. Please include in the body of your
message
subscribe cert-advisory
* "CERT" and "CERT Coordination Center" are registered in the U.S.
Patent and Trademark Office.
______________________________________________________________________
NO WARRANTY
Any material furnished by Carnegie Mellon University and the Software
Engineering Institute is furnished on an "as is" basis. Carnegie
Mellon University makes no warranties of any kind, either expressed or
implied as to any matter including, but not limited to, warranty of
fitness for a particular purpose or merchantability, exclusivity or
results obtained from use of the material. Carnegie Mellon University
does not make any warranty of any kind with respect to freedom from
patent, trademark, or copyright infringement.
______________________________________________________________________
Conditions for use, disclaimers, and sponsorship information
Copyright 2003 Carnegie Mellon University.
Revision History
July 25, 2003: Initial release
-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.8
iQCVAwUBPyF6V2jtSoHZUTs5AQFGtgP/VJsEVZ1blK04pZhjSIlJuPJJg1PU4Xwi
/lvJFdpvkqKrEH27NHBkfJGN/rSs7kinSq6dEsJeenjb3rcDQMd/VdFEm83cF51/
NDyMt4osvtXveYSR1oorbMbSVQ4tF5yItsOchRfZsfigyk3tvzPA1kawuWBxy2KZ
Gmjs9RLgmxI=
=3ICC
-----END PGP SIGNATURE-----
| Powered by: | MHonArc  |
