CVE-2009-0555: Code Injection

Published Oct 14, 2009

Updated

Microsoft Windows Media Runtime, as used in DirectShow WMA Voice Codec, Windows Media Audio Voice Decoder, and Audio Compression Manager (ACM), does not properly process Advanced Systems Format (ASF) files, which allows remote attackers to execute arbitrary code via a crafted audio file that uses the Windows Media Speech codec, aka "Windows Media Runtime Voice Sample Rate Vulnerability."

Affected Software

20 affected components

Microsoft Windows 2000=sp4

Microsoft Windows Media Format Runtime=9.0

Microsoft Windows Media Player=9

Microsoft Windows Media Format Runtime=9.5

Microsoft Windows Media Format Runtime=11

Microsoft Windows XP=sp2

Microsoft Windows XP=sp3

Microsoft Windows Server 2003=sp2

Microsoft Windows Server 2008

Microsoft Windows Server 2008=sp2

Microsoft Windows Vista

Microsoft Windows Vista=sp1

Microsoft Windows Vista=sp2

Remediation

Patch Available

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-051

Event History

Oct 14, 2009

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Data Sourced

10:30 AM

DescriptionWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2009-0555?

CVE-2009-0555 is rated as critical due to its potential for remote code execution.

How do I fix CVE-2009-0555?

To fix CVE-2009-0555, apply the security updates provided by Microsoft for affected versions of Windows.

What software is affected by CVE-2009-0555?

CVE-2009-0555 affects multiple Microsoft software, including Windows Media Player 9, Windows XP SP2, and Windows Vista SP1.

What kind of attack does CVE-2009-0555 represent?

CVE-2009-0555 allows remote attackers to execute arbitrary code via a crafted ASF file.

When was CVE-2009-0555 disclosed?

CVE-2009-0555 was disclosed in October 2009, with a security bulletin released by Microsoft.