Extremely critical 0-day exploit of Microsoft DirectX

General Topics
1

I posted this in another tech forum last week, and I don’t remember seeing it posted here too. I apologize for my tardiness. Until today, I rationalized it would be fixed next Tuesday, but thanks to Bob’s post, I realize this vulnerability is not going to be fixed in Tuesday’s patches. The following post contains a link to Microsoft’s temporary (I hope) FixIt to work around this vulnerability and exploit. I strongly encourage anyone with a vulnerable system to enable the workaround ASAP. Windows Vista is not vulnerable.

2009-05-29 - Extremely critical 0-day exploit of Microsoft DirectX
Does not appear to affect all versions of Windows Vista and Windows Server 2008
Secunia Advisory http://secunia.com/advisories/35268/
Microsoft workaround http://support.microsoft.com/kb/971778
According to Microsoft, the vulnerability does not require QuickTime
Affects:
Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Datacenter Server
Microsoft Windows 2000 Professional
Microsoft Windows 2000 Server
Microsoft Windows Server 2003 Datacenter Edition
Microsoft Windows Server 2003 Enterprise Edition
Microsoft Windows Server 2003 Standard Edition
Microsoft Windows Server 2003 Web Edition
Microsoft Windows Storage Server 2003
Microsoft Windows XP Home Edition
Microsoft Windows XP Professional

2

Hi Alan Baxter,

Was also treated in this thread, and I gave a link to a fix here: http://forum.avast.com/index.php?topic=45800.msg383813#msg383813 (and also to undo the fix when the real patch will be there),

polonus

3

Thank you, polonus. I’m glad Marc57 was more prompt than me. I must have seen it here last Monday but forgotten about it. Pretty obvious warning, now that you’ve pointed me to it. ;D

4

What does QuickTime have to do with a DirectX vulnerability? ???

5

“Microsoft today warned that hackers are using rigged QuickTime media files to exploit an unpatched vulnerability in DirectShow,
the APIs used by Windows programs for multimedia support.”

6

Just adding this: http://www.f-secure.com/weblog/archives/00001695.html

Seems they may have spmething good going on with that exploit shield of theirs.