HTTP: Microsoft Windows Cinepak Codec Code Execution

This signature detects attempts to exploit a known remote code execution vulnerability in the Microsoft Windows Cinepak Codec. It is caused by a improper handling of VIDC (Cinepak) streams within the iccvid.dll module. An attacker can exploit this by enticing a target user to open a specially crafted AVI file. In a successful code execution attack, the injected code is executed within the context of the currently logged in user. In an unsuccessful attack, the affected application can terminate abnormally, leading to a denial-of-service condition.

Extended Description

Microsoft Windows is prone to a remote code-execution vulnerability when handling compressed media files. An attacker can exploit this issue by enticing an unsuspecting user to open a malicious file or visit a website containing malicious streaming media content. A successful exploit may allow arbitrary code to run in the context of the currently logged-in user.

Affected Products

Microsoft windows_vista

References

BugTraq: 42256

CVE: CVE-2010-2553

Short Name

HTTP:STC:STREAM:CINEPAK-RCE

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Microsoft Windows Cinepak Codec Code Execution

Extended Description

Affected Products

References

Found a potential security threat?