HTTP: Microsoft Movie Maker hhctrl.ocx load attempt

This signature detects attempts to exploit a known vulnerability in Windows movie maker. It is due to a design weakness in loading configuration files. Remote attackers can exploit this by enticing target users to download a malicious dll file. A successful attack can result in loading the attacker-controlled library and execution of arbitrary code with the privileges of the logged-in user.

Extended Description

Untrusted search path vulnerability in Microsoft Windows Movie Maker (WMM) 2.6 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a Movie Maker (MSWMM) file, aka "Insecure Library Loading Vulnerability."

References

CVE: CVE-2010-3967

Short Name

HTTP:MISC:MS-MOVIE-MAKER-OCX

Severity

Minor

Recommended

False

Recommended Action

Drop

HTTP: Microsoft Movie Maker hhctrl.ocx load attempt

Extended Description

References

Found a potential security threat?