----------------------------------------------------------------------

2003: 2,700 advisories published
2004: 3,100 advisories published
2005: 4,600 advisories published
2006: 5,300 advisories published

How do you know which Secunia advisories are important to you?

The Secunia Vulnerability Intelligence Solutions allows you to filter
and structure all the information you need, so you can address issues
effectively.

Get a free trial of the Secunia Vulnerability Intelligence Solutions:
http://corporate.secunia.com/how_to_buy/38/vi/?ref=secadv

----------------------------------------------------------------------

TITLE:
Windows Media Format Runtime ASF Parsing Vulnerability

SECUNIA ADVISORY ID:
SA28034

VERIFY ADVISORY:
http://secunia.com/advisories/28034/

CRITICAL:
Highly critical

IMPACT:
System access

WHERE:
>From remote

OPERATING SYSTEM:
Microsoft Windows XP Professional
http://secunia.com/product/22/
Microsoft Windows XP Home Edition
http://secunia.com/product/16/
Microsoft Windows Vista
http://secunia.com/product/13223/
Microsoft Windows Storage Server 2003
http://secunia.com/product/12399/
Microsoft Windows Server 2003 Web Edition
http://secunia.com/product/1176/
Microsoft Windows Server 2003 Standard Edition
http://secunia.com/product/1173/
Microsoft Windows Server 2003 Enterprise Edition
http://secunia.com/product/1174/
Microsoft Windows Server 2003 Datacenter Edition
http://secunia.com/product/1175/
Microsoft Windows 2000 Server
http://secunia.com/product/20/
Microsoft Windows 2000 Professional
http://secunia.com/product/1/
Microsoft Windows 2000 Datacenter Server
http://secunia.com/product/1177/
Microsoft Windows 2000 Advanced Server
http://secunia.com/product/21/

SOFTWARE:
Microsoft Windows Media Format Runtime 9.x
http://secunia.com/product/16898/
Microsoft Windows Media Format Runtime 7.x
http://secunia.com/product/16897/
Microsoft Windows Media Format Runtime 11.x
http://secunia.com/product/16899/
Microsoft Windows Media Services 9.x
http://secunia.com/product/16900/

DESCRIPTION:
A vulnerability has been reported in Windows Media Format Runtime /
Windows Media Services, which can be exploited by malicious people to
compromise a user's system.

The vulnerability is caused due to an error when parsing ASF
(Advanced Systems Format) files and can be exploited when a user
views a specially crafted ASF file in an application using the
component (e.g. Windows Media Player).

Successful exploitation may allow execution of arbitrary code.

SOLUTION:
Apply patches.

Windows 2000 SP4 with Windows Media Format Runtime 7.1:
http://www.microsoft.com/downloads/details.aspx?FamilyID=eecdf2ce-9aa7-4f0c-b62b-2fa7a32f369e

Windows 2000 SP4 with Windows Media Format Runtime 9:
http://www.microsoft.com/downloads/details.aspx?FamilyID=eecdf2ce-9aa7-4f0c-b62b-2fa7a32f369e

Windows XP SP2 with Windows Media Format Runtime 9:
http://www.microsoft.com/downloads/details.aspx?FamilyID=bece702a-6e61-433e-8275-20f4e84f2c92

Windows XP SP2 with Windows Media Format Runtime 9.5:
http://www.microsoft.com/downloads/details.aspx?FamilyID=bece702a-6e61-433e-8275-20f4e84f2c92

Windows XP Professional x64 Edition (optionally with SP2) with
Windows Media Format Runtime 9.5:
http://www.microsoft.com/downloads/details.aspx?FamilyID=81f20b45-dfc7-4ddf-a4b4-6c0e9476ed51

Windows Server 2003 SP1/SP2 with Windows Media Format Runtime 9.5:
http://www.microsoft.com/downloads/details.aspx?FamilyID=8fea7da8-a7f3-4786-97c2-fb5ea7018159

Windows Server 2003 x64 Edition (optionally with SP2) with Windows
Media Format Runtime 9.5:
http://www.microsoft.com/downloads/details.aspx?FamilyID=ffc69c76-02f1-4b15-8ec1-dab8c7e33bd4

Windows XP Professional x64 Edition (optionally with SP2) with
Windows Media Format Runtime 9.5 x64 Edition:
http://www.microsoft.com/downloads/details.aspx?FamilyID=72d2ca0e-da81-45ee-9321-4970b80f4a5a

Windows Server 2003 x64 Edition (optionally with SP2) with Windows
Media Format Runtime 9.5 x64 Edition:
http://www.microsoft.com/downloads/details.aspx?FamilyID=ffc69c76-02f1-4b15-8ec1-dab8c7e33bd4

Windows XP SP2 with Windows Media Format Runtime 11:
http://www.microsoft.com/downloads/details.aspx?FamilyID=bece702a-6e61-433e-8275-20f4e84f2c92
  
Windows XP Professional x64 Edition (optionally with SP2) with
Windows Media Format Runtime 11:
http://www.microsoft.com/downloads/details.aspx?FamilyID=1037b224-ac89-4efd-b189-6f3da77a88e6

Windows Vista with Windows Media Format Runtime 11:
http://www.microsoft.com/downloads/details.aspx?FamilyID=9a98ef96-bc2e-42b7-9a24-c82c8fb379db

Windows Vista x64 Edition with Windows Media Format Runtime 11:
http://www.microsoft.com/downloads/details.aspx?FamilyID=3ce02c95-d695-4f14-9fb3-30c83a9cfb9c

Windows Server 2003 SP1/SP2 with Windows Media Services 9.1:
http://www.microsoft.com/downloads/details.aspx?FamilyID=096711d4-ce01-45d0-9c2d-ebfa5c671b9f

Windows Server 2003 x64 Edition (optionally with SP2) with Windows
Media Services 9.1 x64 Edition:
http://www.microsoft.com/downloads/details.aspx?FamilyID=23c23800-5aaa-455b-96bf-4ead4dfdd95d

PROVIDED AND/OR DISCOVERED BY:
The vendor credits Ryan Smith, ISS X-Force.

ORIGINAL ADVISORY:
MS07-068 (KB941569 / KB944275):
http://www.microsoft.com/technet/security/Bulletin/MS07-068.mspx

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------