JVNDB-2009-000059

Buffer overflow vulnerability in Microsoft Windows

Microsoft Windows contains a buffer overflow vulnerability.

Windows Media Format Runtime included in Microsoft Windows contains a buffer overflow vulnerability when parsing specific files.

The security update for this vulnerability is contained in the Microsoft Security Bulletin Summary for September 2009.

Hiroshi Noguchi of Alice Carroll fan club reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Microsoft Corporation

• Microsoft Windows 2000
• Microsoft Windows Server 2003
• Microsoft Windows Server 2003 (x64)
• Microsoft Windows Server 2008
• Microsoft Windows Server 2008 (x64)
• Microsoft Windows Vista
• Microsoft Windows Vista (x64)
• Microsoft Windows XP sp3
• Microsoft Windows XP (x64)

If a user opens a specially crafted file, an attacker may execute arbitrary code.

[Update the software]
Apply the update according to the information provided by Microsoft.

Microsoft Corporation

• Microsoft Corporation : Microsoft Security Bulletin Summary for September 2009
• Microsoft Corporation : Microsoft Update
• Microsoft Security Bulletin : MS09-047

1. Buffer Errors(CWE-119) [IPA Evaluation]

1. CVE-2009-2498
2. CVE-2009-2499

1. JVN : JVN#62211338
2. National Vulnerability Database (NVD) : CVE-2009-2498
3. National Vulnerability Database (NVD) : CVE-2009-2499
4. IPA SECURITY ALERTS : Security Alert for Vulnerability in Microsoft Windows
5. US-CERT Cyber Security Alerts : SA09-251A
6. US-CERT Technical Cyber Security Alert : TA09-251A
7. Secunia Advisory : SA36596
8. SecurityFocus : 36225
9. SecurityFocus : 36228
10. VUPEN Security : VUPEN/ADV-2009-2566

• [2009/09/09]
    Web page published