QuickTime Vulnerability in DirectShow Discovered, Microsoft Announced
Redmond-based software developer Microsoft has announced that there is a remote code execution vulnerability affecting its DirectShow Platform when parsing QuickTime files. What this means is that if a person with malicious intent gets you to open a specially crafted QuickTime media file, then said person could perform remote code execution. At this time Microsoft has identified active but limited attacks. It must be noted that no Vista OS version is affected, only Windows 2000 SP4, XP and Server 2003.
The Microsoft Security Response Center issued a statement on the subject: “We’ve just released Microsoft Security Advisory 971778 today. This discusses a new vulnerability in Microsoft DirectShow affecting Windows 2000, Windows XP and Windows Server 2003 that is under limited attack. The advisory outlines information about the vulnerability and steps customers can take to protect themselves while we’re working on a security update to address the issue. Our investigation has shown that the vulnerable code was removed as part of our work building Windows Vista. This means that Windows Vista and versions of Windows since Windows Vista (Windows Server 2008, Windows 7) are not vulnerable.”
The vulnerability is to be found in the QuickTime parser in Microsoft DirectShow. For the attacker to exploit it, then he would have to create a malicious QuickTime and then post it online or attach it to outgoing emails. This is not a browser flaw, it is a quartz.dll flaw – the attacker could set up a malicious web page that uses media playback plug-ins which would allow the malicious QuickTime file to access the quartz.dll vulnerability. If you receive a malicious QuickTime file via email and you open it via Windows Media Player, the vulnerability could be triggered this way also.
Available workarounds:
1. Disable QuickTime parsing in quartz.dll by deleting this key:
HKEY_CLASSES_ROOTCLSID{D51BD5A0-7548-11CF-A520-0080C77EF58A}
2. Kill-bit WMP ActiveX Control
Set the following registry key to apply the killbit:
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerActiveX Compatibility{6BF52A52-394A-11D3-B153-00C04F79FAA6}]
"Compatibility Flags"=dword:00000400
3. Unregister/ACL quartz.dll
But according to the MSRC there is a simpler way to go about things: "we have found one workaround in particular that is simple and effective and protects against the vulnerability with limited impact. In fact, this particular workaround is simple enough that we’ve been able to give you a way to automatically implement the workaround with the click of a button. Our Customer Service and Support (CSS) group has a new capability called “ Fix it ” that can automatically apply simple solutions to your system. We’ve gone ahead and built a “Fix it” that implements the “Disable the parsing of QuickTime content in quartz.dll” registry change workaround. We have also built a "Fix it" that will undo the workaround automatically."
If you would like to read Microsoft’s Security Advisory 971778 “Vulnerability in Microsoft DirectShow Could Allow Remote Code Execution”, you can do so here.
The Knowledge Base article with the simple Fix It workaround is availabe here .
Tags: Microsoft, QuickTime, Parsing, quartz.dll, security, DirectShow
The Microsoft Security Response Center issued a statement on the subject: “We’ve just released Microsoft Security Advisory 971778 today. This discusses a new vulnerability in Microsoft DirectShow affecting Windows 2000, Windows XP and Windows Server 2003 that is under limited attack. The advisory outlines information about the vulnerability and steps customers can take to protect themselves while we’re working on a security update to address the issue. Our investigation has shown that the vulnerable code was removed as part of our work building Windows Vista. This means that Windows Vista and versions of Windows since Windows Vista (Windows Server 2008, Windows 7) are not vulnerable.”
Advertising
The vulnerability is to be found in the QuickTime parser in Microsoft DirectShow. For the attacker to exploit it, then he would have to create a malicious QuickTime and then post it online or attach it to outgoing emails. This is not a browser flaw, it is a quartz.dll flaw – the attacker could set up a malicious web page that uses media playback plug-ins which would allow the malicious QuickTime file to access the quartz.dll vulnerability. If you receive a malicious QuickTime file via email and you open it via Windows Media Player, the vulnerability could be triggered this way also.
Available workarounds:
1. Disable QuickTime parsing in quartz.dll by deleting this key:
HKEY_CLASSES_ROOTCLSID{D51BD5A0-7548-11CF-A520-0080C77EF58A}
2. Kill-bit WMP ActiveX Control
Set the following registry key to apply the killbit:
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerActiveX Compatibility{6BF52A52-394A-11D3-B153-00C04F79FAA6}]
"Compatibility Flags"=dword:00000400
3. Unregister/ACL quartz.dll
But according to the MSRC there is a simpler way to go about things: "we have found one workaround in particular that is simple and effective and protects against the vulnerability with limited impact. In fact, this particular workaround is simple enough that we’ve been able to give you a way to automatically implement the workaround with the click of a button. Our Customer Service and Support (CSS) group has a new capability called “ Fix it ” that can automatically apply simple solutions to your system. We’ve gone ahead and built a “Fix it” that implements the “Disable the parsing of QuickTime content in quartz.dll” registry change workaround. We have also built a "Fix it" that will undo the workaround automatically."
If you would like to read Microsoft’s Security Advisory 971778 “Vulnerability in Microsoft DirectShow Could Allow Remote Code Execution”, you can do so here.
The Knowledge Base article with the simple Fix It workaround is availabe here .
Tags: Microsoft, QuickTime, Parsing, quartz.dll, security, DirectShow
I Hope you LIKE this blog post! Thank you!
What do YOU have to say about this
blog comments powered by Disqus
Popular News
By George Norman on 10 Feb 2012
With the release of Wolfram|Alpha Pro, the team behind the popular computational knowledge engine took a very big step forward
By George Norman on 10 Feb 2012
Microsoft has just announced that this February, as part of the Patch Tuesday program, it will roll out a grand total of 9 security bulletins to all customers all over the world.Related News
By George Norman on 23 Dec 2011
Redmond-based software giant Microsoft has said goodbye to its keynote presentation and booth at the Consumer Electronics Show (CES), the technology trade show held each January in the Las Vegas Convention Center. 
By George Norman on 02 Dec 2011
With 2011 quickly drawing to an end, the team behind Microsoft’s Bing search engine made public a list of the most popular searches on Bing in 2011. The list includes the most searched people, the most searched news stories, the most searched sports stars
By George Norman on 21 Sep 2011
One million students from low-income families in the US will have access to software, hardware, and discounted broadband internet service courtesy of Redmond-based software giant Microsoft. 
By George Norman on 27 Oct 2011
It is true that the mouse is one of the most used peripheral and it is just as true that if you want to get things done and get them done fast, using keyboard shortcuts is a lot more efficient than clicking.Advertising
Hot Software Updates
Top Downloads
2.
Opera5.
Trillian8.
AIM9.
Skype10.
Ad-Aware12.
Nero13.
Google Earth14.
Picasa15.
Winamp16.
iTunes17.
RealPlayer18.
uTorrent19.
eMule20.
WinRAR21.
BitComet22.
WinZip23.
Shareaza24.
CCleaner25.
Recuva26.
Tweak UI27.
CuteFTP Home29.
Adobe Reader30.
NewsPiperBecome A Fan!
Link To Us!
QuickTime Vulnerability in DirectShow Discovered, Microsoft Announced
HTML Linking Code
HTML Linking Code