Title

Microsoft Cinepak Codec Remote Code Execution Vulnerability (Cat II impact)

Discussion

Microsoft has released a security bulletin addressing a vulnerability affecting Microsoft Cinepak Codec. The Cinepak Codec is a media encoder and decoder supported by the Windows Media Player. To exploit this vulnerability, an attacker would entice a user to access a malicious media file or streaming content hosted on a web site or sent via email. If successfully exploited, this vulnerability would allow an attacker to execute arbitrary code in the context of the currently logged-in user. At this time, there are no known exploits associated with this vulnerability; USCYBERCOM is not aware of any DoD related incidents. Cinepak Codec Decompression Vulnerability - (CVE-2010-2553): A remote code execution vulnerability exists in the way the Cinepak codec handles supported format files. This vulnerability could allow code execution if a user opened a specially crafted media file. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Check Content

See IAVM notice and vendor bulletin for additional information. Microsoft Bulletin MS10-055 (982665). Vulnerable Applications/Systems: Windows XP SP3 Windows XP Professional x64 Edition SP2 Windows Vista SP1 and SP2 (x86 and x64) Windows 7 (x86 and x64) Verify that the patch has been installed by checking that the following sample file is at the version indicated or later. See the vendor bulletin for additional information and any Vulnerable Systems\Applications not listed below. Iccvid.dll Windows XP 1.10.0.13 Windows Vista 1.10.0.13 Windows 7 Fixed by SP1 Windows 7 1.10.0.13

Fix Text

Additional Identifiers

Rule ID:

Vulnerability ID: V-25067

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.