National Cyber Awareness System

Vulnerability Summary for CVE-2008-0015

Overview

Stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL), as used in the MPEG2TuneRequest ActiveX control in msvidctl.dll in DirectShow, in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a crafted web page, as exploited in the wild in July 2009, aka "Microsoft Video ActiveX Control Vulnerability."

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Technical Alert: TA09-223A

Name: TA09-223A

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA09-223A.html

US-CERT Technical Alert: TA09-195A

Name: TA09-195A

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA09-195A.html

US-CERT Technical Alert: TA09-187A

Name: TA09-187A

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA09-187A.html

US-CERT Vulnerability Note: VU#180513

Name: VU#180513

Hyperlink:http://www.kb.cert.org/vuls/id/180513

External Source: VUPEN

Name: ADV-2009-2232

Hyperlink:http://www.vupen.com/english/advisories/2009/2232

External Source: SECTRACK

Name: 1022514

Hyperlink:http://www.securitytracker.com/id?1022514

External Source: BID

Name: 35585

Hyperlink:http://www.securityfocus.com/bid/35585

External Source: BID

Name: 35558

Hyperlink:http://www.securityfocus.com/bid/35558

External Source: MS

Name: MS09-037

Hyperlink:http://www.microsoft.com/technet/security/Bulletin/MS09-037.mspx

External Source: MS

Name: MS09-032

Hyperlink:http://www.microsoft.com/technet/security/Bulletin/MS09-032.mspx

External Source: CONFIRM

Name: http://www.microsoft.com/technet/security/advisory/972890.mspx

Type: Advisory

Hyperlink:http://www.microsoft.com/technet/security/advisory/972890.mspx

External Source: ISS

Name: 20090706 Multiple Microsoft Video Control ActiveX Remote Code Execution Vulnerabilities

Hyperlink:http://www.iss.net/threats/329.html

External Source: MISC

Name: http://www.csis.dk/dk/nyheder/nyheder.asp?tekstID=799

Hyperlink:http://www.csis.dk/dk/nyheder/nyheder.asp?tekstID=799

External Source: SECUNIA

Name: 36187

Hyperlink:http://secunia.com/advisories/36187

External Source: OVAL

Name: oval:org.mitre.oval:def:7436

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:7436

External Source: OVAL

Name: oval:org.mitre.oval:def:6363

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6363

External Source: OVAL

Name: oval:org.mitre.oval:def:6333

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6333

External Source: OSVDB

Name: 55651

Hyperlink:http://osvdb.org/55651

External Source: MISC

Name: http://isc.sans.org/diary.html?storyid=6733

Hyperlink:http://isc.sans.org/diary.html?storyid=6733

External Source: MISC

Name: http://blogs.technet.com/srd/archive/2009/08/11/ms09-037-why-we-are-using-cve-s-already-used-in-ms09-035.aspx

Hyperlink:http://blogs.technet.com/srd/archive/2009/08/11/ms09-037-why-we-are-using-cve-s-already-used-in-ms09-035.aspx

References to Check Content

Identifier:oval:org.mitre.oval:def:6363

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:6363

Identifier:oval:org.mitre.oval:def:7436

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:7436

Identifier:oval:org.mitre.oval:def:6333

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:6333