Title

Microsoft Windows Media Center Remote Code Execution Vulnerability (Cat II impact)

Discussion

Microsoft has released a security bulletin addressing a vulnerability in Windows Media Center. To exploit this vulnerability, an attacker would convince a user to open a legitimate file that is located in the same network directory as a specially crafted dynamic link library (DLL) file. If successfully exploited, at attacker would execute arbitrary code and compromise of affected systems. At this time, there are known proof of concept exploits associated with this vulnerability; USCYBERCOM is not aware of any DoD related incidents. Microsoft Windows Media Center Insecure Library Loading Vulnerability - (CVE-2011-2009): A remote code execution vulnerability exists in the way that Windows Media Center handles the loading of DLL files. The vulnerability is the result of Windows Media Player improperly restricting the path used when loading external libraries. An attacker who successfully exploited this vulnerability could take complete control of an affected system.

Check Content

See IAVM notice and vendor bulletin for additional information. Microsoft Bulletin MS11-076 (2579686). Vulnerable Applications/Systems: Windows Vista SP2 (x86* and x64*) Windows 7 (x86 and x64) Windows 7 SP1 (x86 and x64) *Note: Windows Media Center TV Pack for Windows Vista is available only on Original Equipment Manufacturer (OEM) installations of the Home Premium and Ultimate editions of Windows Vista as an optional component. Verify that the patch has been installed by checking that the following sample file is at the version indicated or later. See the vendor bulletin for additional information and any Vulnerable Systems/Applications not listed below. Psisdecd.dll Windows Vista SP2 – 6.6.6002.18496 or 22686 Windows 7 - 6.6.7600.16867 or 21030 Windows 7 SP1 - 6.6.7601.17669 or 21792

Fix Text

Additional Identifiers

Rule ID:

Vulnerability ID: V-30403

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.