HTTP: Microsoft DirectX WAV and AVI File Parsing Code Execution

This signature detects attempts to exploit a known buffer overflow vulnerability in Microsoft DirectX application framework. It is due to the way certain DirectX libraries handle specially crafted WAV and AVI files. A remote attacker can exploit this by persuading a user to open a specially crafted WAV or AVI file, potentially causing arbitrary code to be injected and executed in the security context of the logged in user. In a successful code injection attack, the behavior of the target host is entirely dependent on the intended function of the injected code and execute within the security context of the current user. In an unsuccessful attack, the application utilizing the vulnerable DirectX library terminates.

Extended Description

Buffer overflow in Microsoft DirectShow in Microsoft DirectX 7.0 through 10.0 allows remote attackers to execute arbitrary code via a crafted (1) WAV or (2) AVI file.

References

BugTraq: 26804

CVE: CVE-2007-3895

Short Name

HTTP:STC:DIRECTX-AVI-WAV-PARSE

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Microsoft DirectX WAV and AVI File Parsing Code Execution

Extended Description

References

Found a potential security threat?