HTTP: Microsoft DirectX SAMI File Parsing Code Execution

This signature detects attempts to exploit a known buffer overflow vulnerability in Microsoft DirectX application framework. A successful attack can lead to arbitrary code execution.

Extended Description

DirectX is prone to a stack-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data An attacker could exploit this issue to execute arbitrary code within the privileges of the currently logged-in user. Failed exploit attempts may crash the application. NOTE: Windows Media Player 6.4 on Windows 2000 was previously stated not to be an attack vector. The vendor has corrected this information to state that it is a possible attack vector.

Affected Products

Avaya messaging_application_server,Microsoft directx

References

BugTraq: 26789 49149

CVE: CVE-2007-3901

URL: http://labs.mwrinfosecurity.com/files/Advisories/mwri_mplayer-sami-subtitles_2011-08-12.pdf http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=632

Short Name

HTTP:STC:DL:DIRECTX-SAMI

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Microsoft DirectX SAMI File Parsing Code Execution

Extended Description

Affected Products

References

Found a potential security threat?