Signature Detail

APP: Microsoft Windows Media Service Remote Code Execution

This signature detects attempts to exploit a known vulnerability against Windows Media Service. A successful attack can allow attackers to take complete control of an affected system. Thereby enabling them to install programs; view, change, delete data; or create new accounts with full user rights.

Extended Description

Microsoft Windows Media Service is prone to a remote stack-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data. Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. Update (April 21, 2010): Microsoft reports that the patch released as MS10-025 does not resolve this issue. Microsoft intends to release a new fix in the following week; this BID will be updated as more information emerges. Update (April 27, 2010): Updated MS10-025 includes a new fix.

Affected Products

• Microsoft windows_2000_advanced_server SP1
• Microsoft windows_2000_advanced_server SP2
• Microsoft windows_2000_advanced_server SP3
• Microsoft windows_2000_advanced_server SP4
• Microsoft windows_2000_advanced_server
• Microsoft windows_2000_datacenter_server SP1
• Microsoft windows_2000_datacenter_server SP2
• Microsoft windows_2000_datacenter_server SP3
• Microsoft windows_2000_datacenter_server SP4
• Microsoft windows_2000_datacenter_server
• Microsoft windows_2000_professional SP1
• Microsoft windows_2000_professional SP2
• Microsoft windows_2000_professional SP3
• Microsoft windows_2000_professional SP4
• Microsoft windows_2000_professional
• Nortel_networks ensm_visualization_performance_fault_manager_vpfm
• Nortel_networks self_service-cdd
• Nortel_networks self-service_media_processing_server
• Nortel_networks self-service_mps_1000
• Nortel_networks self-service_mps_500
• Nortel_networks self-service_peri_application
• Nortel_networks self-service_speech_server

References

• CVE: CVE-2010-0478
• URL: https://www.lexsi.com/abonnes/labs/adviso-cve-2010-0478.txt