Recent Posts

Community

Email Notifications

Personal Links

Archives

Harry Waldron - IT Security

Security Developments, Software Updates and Best Practices

MS Advisory 971778 - Directshow Exploit circulating in-the-wild

Movie Exploits are circulating for this unpatched vulnerability that mainly affects some special options for Quick Time. The FixIt workaround provides an easy-to-use workaround for now and can be easily disabled if it breaks needed Quick Time functionality:

Yes FixIt Registry update can provide protection
(can be enabled/disabled easily)
http://support.microsoft.com/default.aspx/kb/971778

More details can be found in links below:

Lightning DirectShow Exploits circulating in wild
http://myitforum.com/cs2/blogs/cmosby/archive/2009/06/18/directshow-exploit-in-the-wild-symantec-security-response-blog.aspx
https://forums2.symantec.com/t5/blogs/blogarticlepage/blog-id/vulnerabilities_exploits/article-id/198

Technical Details on current exploit
http://www.symantec.com/security_response/writeup.jsp?docid=2009-061001-1828-99&tabid=2

Star Key Microsoft Links
http://www.microsoft.com/technet/security/advisory/971778.mspx
http://support.microsoft.com/default.aspx/kb/971778
http://blogs.technet.com/msrc/archive/2009/05/28/microsoft-security-advisory-971778-vulnerability-in-microsoft-directshow-released.aspx
http://blogs.technet.com/srd/archive/2009/05/28/new-vulnerability-in-quicktime-parsing.aspx

Star Additional Links
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1537
http://secunia.com/advisories/35268

QUOTE (Secunia): According to Microsoft, the vulnerability is currently being actively exploited.