Vulnerability Name: CVE-2008-0011 (CCN-39052) Assigned: 2007-12-13 Published: 2008-06-10 Updated: 2018-10-12 Summary: Microsoft DirectX 8.1 through 9.0c, and DirectX on Microsoft XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008, does not properly perform MJPEG error checking, which allows remote attackers to execute arbitrary code via a crafted MJPEG stream in a (1) AVI or (2) ASF file, aka the "MJPEG Decoder Vulnerability." CVSS v3 Severity: 10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Exploitability Metrics: Attack Vector (AV): NetworkAttack Complexity (AC): LowPrivileges Required (PR): NoneUser Interaction (UI): NoneScope: Scope (S): ChangedImpact Metrics: Confidentiality (C): HighIntegrity (I): HighAvailibility (A): High
CVSS v2 Severity: 9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C 6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C Exploitability Metrics: Access Vector (AV): NetworkAccess Complexity (AC): MediumAuthentication (Au): NoneImpact Metrics: Confidentiality (C): CompleteIntegrity (I): CompleteAvailibility (A): Complete
9.3 High (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C 6.9 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C Exploitability Metrics: Access Vector (AV): NetworkAccess Complexity (AC): MediumAthentication (Au): NoneImpact Metrics: Confidentiality (C): CompleteIntegrity (I): CompleteAvailibility (A): Complete
Vulnerability Type: CWE-119 Vulnerability Consequences: Gain Access References: Source: MITRECVE-2008-0011 Storage Management Appliance (SMA), Microsoft Patch Applicability MS08-030 to MS08-036 HPSBST02344 Microsoft DirectX MJPEG/SAMI File Processing Vulnerabilities 30579 Microsoft DirectX MJPEG Stream Error Handling Bug Lets Remote Users Execute Arbitrary Code 1020222 MS08-033 Vulnerabilities in DirectX Could Allow Remote Code Execution (951698) Nortel Response to Microsoft Security Bulletin MS08-033 Centrex IP Client Manager (CICM) response to Microsoft June security bulletin Vulnerability in Media Decompression Could Allow Remote Code Execution (2780091) Security Update for Microsoft Windows to Address Remote Code Execution (3124901) Security update for Microsoft Windows to Address Remote Code Execution (3134228) Security Update for SAM and LSAD Remote Protocols (3148527) Security Update for Windows SMB Server (3164038) Security Update for Netlogon (3167691) Security Update for Windows Authentication Methods (3178465) Security Update for Windows (3178467) Security Update for Windows Kernel (3186973) Security Update for Microsoft Graphics Component (3192884) Security Update for Microsoft Video Control (3195360) Security Update for Kernel-Mode Drivers (3192892) Security Update for Windows Registry (3193227) Security Update for Microsoft Internet Messaging API (3196067) Security Update for Microsoft Video Control (3199151) Security Update for Windows Kernel (3199720) Security Update for .NET Framework (3205640) Cumulative Security Update for Internet Explorer (4013073) Security Update for Microsoft Graphics Component (4013075) Vulnerabilities in DirectX Could Allow Remote Code Execution (951698) Vulnerability in Microsoft DirectShow Could Allow Remote Code Execution (961373) Vulnerabilities in Microsoft DirectShow Could Allow Remote Code Execution (971633) Vulnerability in Microsoft DirectShow Could Allow Remote Code Execution (977935) Vulnerabilities in Media Decompression Could Allow Remote Code Execution (979902) Vulnerability in Windows Media Encoder Could Allow Remote Code Execution (2447961 Vulnerabilities in Windows Media Could Allow Remote Code Execution (2636391) 29581 Microsoft DirectX MJPEG Video Streaming Stack Based Buffer Overflow Vulnerability TA08-162B ADV-2008-1780 MS08-033 multimedia-codec-stack-bo(39052) oval:org.mitre.oval:def:5236 Vulnerable Configuration: Configuration 1 :cpe:/o:microsoft:windows_xp:-:sp3:*:*:*:*:*:* OR cpe:/o:microsoft:windows_2000:*:sp4:*:*:*:*:*:* OR cpe:/o:microsoft:windows_2003_server:*:*:x64:*:*:*:*:* OR cpe:/o:microsoft:windows_2003_server:*:sp1:*:*:*:*:*:* OR cpe:/o:microsoft:windows_2003_server:*:sp1:itanium:*:*:*:*:* OR cpe:/o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:* OR cpe:/o:microsoft:windows_2003_server:*:sp2:itanium:*:*:*:*:* OR cpe:/o:microsoft:windows_2003_server:*:sp2:x64:*:*:*:*:* OR cpe:/o:microsoft:windows_xp:*:*:x64:*:*:*:*:* OR cpe:/o:microsoft:windows_xp:*:sp2:*:*:*:*:*:* OR cpe:/o:microsoft:windows_xp:*:sp2:x64:*:*:*:*:* AND cpe:/a:microsoft:directx:9.0:*:*:*:*:*:*:* Configuration 2 :cpe:/o:microsoft:windows_2000:*:sp4:*:*:*:*:*:* AND cpe:/a:microsoft:directx:7.0:*:*:*:*:*:*:* OR cpe:/a:microsoft:directx:8.1:*:*:*:*:*:*:* Configuration 3 :cpe:/o:microsoft:windows-nt:2008:*:itanium:*:*:*:*:* OR cpe:/o:microsoft:windows-nt:2008:*:x32:*:*:*:*:* OR cpe:/o:microsoft:windows-nt:2008:*:x64:*:*:*:*:* OR cpe:/o:microsoft:windows_vista:*:*:x64:*:*:*:*:* AND cpe:/a:microsoft:directx:10.0:*:*:*:*:*:*:* Configuration CCN 1 :cpe:/a:microsoft:directx:8.1:*:*:*:*:*:*:* OR cpe:/a:microsoft:directx:9.0a:*:*:*:*:*:*:* OR cpe:/a:microsoft:directx:9.0:*:*:*:*:*:*:* OR cpe:/a:microsoft:directx:9.0b:*:*:*:*:*:*:* OR cpe:/a:microsoft:directx:9.0c:*:*:*:*:*:*:* OR cpe:/a:microsoft:directx:10.0:*:*:*:*:*:*:* Oval Definitions BACK
microsoft windows-nt xp sp3
microsoft windows 2000 * sp4
microsoft windows 2003 server *
microsoft windows 2003 server * sp1
microsoft windows 2003 server * sp1
microsoft windows 2003 server * sp2
microsoft windows 2003 server * sp2
microsoft windows 2003 server * sp2
microsoft windows xp *
microsoft windows xp * sp2
microsoft windows xp * sp2
microsoft directx 9.0
microsoft windows 2000 * sp4
microsoft directx 7.0
microsoft directx 8.1
microsoft windows-nt 2008
microsoft windows-nt 2008
microsoft windows-nt 2008
microsoft windows vista *
microsoft directx 10.0
microsoft directx 8.1
microsoft directx 9.0a
microsoft directx 9.0
microsoft directx 9.0b
microsoft directx 9.0c
microsoft directx 10.0
Denotes that component is vulnerable