HTTP: Microsoft Windows Media Format ASF Parsing Buffer Overflow

This signature detects attempts to exploit a known buffer overflow vulnerability in Microsoft Windows Media Format library. It is caused due to a boundary error when processing Advanced Systems Format (ASF) files. A remote attacker can exploit this by enticing the target user to open crafted ASF file, which if successful, allows arbitrary code to be injected and executed in the security context of the currently logged in user.

Extended Description

Windows Media Player is prone to a buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied data. Attackers may attempt to exploit this issue by coercing users to visit a malicious website or to access malicious ASF files. Successfully exploiting this issue allows remote attackers to execute arbitrary machine code in the context of the user running the affected application. This facilitates the remote compromise of affected computers.

Affected Products

Avaya s8100_media_servers,Microsoft windows_media_player

References

BugTraq: 21505

CVE: CVE-2006-4702

Short Name

HTTP:STC:STREAM:ASF-BOF

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Microsoft Windows Media Format ASF Parsing Buffer Overflow

Extended Description

Affected Products

References

Found a potential security threat?