HTTP: Microsoft Windows Media Encoder 9 Unsafe ActiveX Control

This signature detects attempts to exploit a known vulnerability in Windows Media Encoder 9. An attacker can create a malicious Web site with Web pages containing dangerous ActiveX calls, which if accessed by a victim, allows the attacker to gain control of the victim's client browser.

Extended Description

The Microsoft Windows Media Encoder 9 ActiveX control is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input. An attacker can exploit this issue to execute arbitrary code in the context of an application using the affected ActiveX control (typically Internet Explorer). Failed attacks will likely cause denial-of-service conditions.

Affected Products

Nortel_networks self-service_speech_server,Nortel_networks media_processing_svr_100

References

BugTraq: 31065

CVE: CVE-2008-3008

URL: http://www.milw0rm.com/exploits/6454

Short Name

HTTP:STC:ACTIVEX:WMEX

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Microsoft Windows Media Encoder 9 Unsafe ActiveX Control

Extended Description

Affected Products

References

Found a potential security threat?