CVE-2009-1539

EUVD-2009-1535 · Published Jul 15, 2009

The QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 does not properly validate unspecified size fields in QuickTime media files, which allows remote attackers to execute arbitrary code via a crafted file, aka "DirectX Size Validation Vulnerability."

Technologies

Microsoft DirectxMicrosoft Windows 2000Microsoft Windows Server 2003Microsoft Windows Xp

Weaknesses

CWE-94

CVSS scores

v2.09.3AV:N/AC:M/Au:N/C:C/I:C/A:C

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access Stealth

T1190Exploit Public-Facing Application T1027.006HTML Smuggling T1027.009Embedded Payloads T1564.009Resource Forking

References

http://osvdb.org/55845
http://www.us-cert.gov/cas/techalerts/TA09-195A.html
http://www.vupen.com/english/advisories/2009/1886
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6341

Potentially impacted assets

See if this affects your attack surface