Vulnerability Note VU#996227

Windows Media Encoder WMEX.DLL ActiveX Control buffer overflow

Overview

The WMEX.DLL ActiveX control, which is installed by Windows Media Encoder 9 Series, contains a buffer overflow vulnerability.

I. Description

According to Microsoft, the Windows Media Encoder is a tool used to capture audio and video content using Windows Media. The WMEX.DLL ActiveX control contains a buffer overflow vulnerability.

II. Impact

By convincing a user to view a specially crafted web page, an attacker may be able to execute arbitrary code with the privileges of the user.

III. Solution

Apply an update

Microsoft has published Microsoft Security Bulletin MS08-053 in response to this issue.

Disable WMEX.DLL in Internet Explorer

According to Microsoft Security Bulletin MS08-053, administrators can set the kill bit for WMEX.DLL.

Do not allow access to WMEX.DLL

Administrators can deny access to WMEX.DLL in Windows 2000, Windows XP, and Windows Server 2003 by running the following command in an administrative command prompt:

Echo y| cacls "C:\Program Files\Windows Media Components\Encoder\wmex.dll" /E /P everyone:N

The same can be done with Windows Vista and Server 2008 by running

Takeown.exe /f "C:\Program Files\Windows Media Components\Encoder\wmex.dll" Icacls.exe "C:\Program Files\Windows Media Components\Encoder\wmex.dll" /save %TEMP%\WMEX_ACL.TXT Icacls.exe "C:\Program Files\Windows Media Components\Encoder\wmex.dll" /deny everyone:(F)

Unregister WMEX.DLL

Administrators can unregister WMEX.DLL by running the following command in an administrative command prompt:

regsvr32.exe -u "C:\Program Files\Windows Media Components\Encoder\wmex.dll

Systems Affected

Vendor	Status	Date Updated
Microsoft Corporation	Vulnerable	9-Sep-2008

References

http://www.microsoft.com/technet/security/bulletin/ms08-Sep.mspx
http://www.microsoft.com/technet/security/bulletin/ms08-053.mspx
http://secunia.com/advisories/31724/

Credit

Microsoft credits Nguyen Minh Duc and Le Manh Tung, with Bach Khoa Internetwork Security Center (BKIS), Hanoi University of Technology (Vietnam), for reporting this vulnerability.

This document was written by John Hollenberger.

Other Information

Date Public	09/09/2008
Date First Published	09/09/2008 02:36:40 PM
Date Last Updated	10/02/2008
CERT Advisory
CVE Name	CVE-2008-3008
Metric	44.89
Document Revision	15

If you have feedback, comments, or additional information about this vulnerability, please send us email.