Vulnerability Note VU#996227

Windows Media Encoder WMEX.DLL ActiveX Control buffer overflow

Original Release date: 09 Sep 2008 | Last revised: 02 Oct 2008

Overview

The WMEX.DLL ActiveX control, which is installed by Windows Media Encoder 9 Series, contains a buffer overflow vulnerability.

Description

According to Microsoft, the Windows Media Encoder is a tool used to capture audio and video content using Windows Media. The WMEX.DLL ActiveX control contains a buffer overflow vulnerability.

Impact

By convincing a user to view a specially crafted web page, an attacker may be able to execute arbitrary code with the privileges of the user.

Solution

Apply an update

Microsoft has published Microsoft Security Bulletin MS08-053 in response to this issue.


Disable WMEX.DLL in Internet Explorer

According to Microsoft Security Bulletin MS08-053, administrators can set the kill bit for WMEX.DLL.

Do not allow access to WMEX.DLL

Administrators can deny access to WMEX.DLL in Windows 2000, Windows XP, and Windows Server 2003 by running the following command in an administrative command prompt:

Echo y| cacls "C:\Program Files\Windows Media Components\Encoder\wmex.dll" /E /P everyone:N

The same can be done with Windows Vista and Server 2008 by running

Takeown.exe /f "C:\Program Files\Windows Media Components\Encoder\wmex.dll"
Icacls.exe "C:\Program Files\Windows Media Components\Encoder\wmex.dll" /save %TEMP%\WMEX_ACL.TXT
Icacls.exe "C:\Program Files\Windows Media Components\Encoder\wmex.dll" /deny everyone:(F)


Unregister WMEX.DLL

Administrators can unregister WMEX.DLL by running the following command in an administrative command prompt:

regsvr32.exe -u "C:\Program Files\Windows Media Components\Encoder\wmex.dll

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
Microsoft CorporationAffected-09 Sep 2008
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

Microsoft credits Nguyen Minh Duc and Le Manh Tung, with Bach Khoa Internetwork Security Center (BKIS), Hanoi University of Technology (Vietnam), for reporting this vulnerability.

This document was written by John Hollenberger.

Other Information

  • CVE IDs: CVE-2008-3008
  • Date Public: 09 Sep 2008
  • Date First Published: 09 Sep 2008
  • Date Last Updated: 02 Oct 2008
  • Severity Metric: 44.89
  • Document Revision: 15

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.