search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Microsoft Indeo video codecs contain multiple vulnerabilities

Vulnerability Note VU#228561

Original Release Date: 2009-12-14 | Last Revised: 2012-03-28


The Indeo video codecs that are provided by Microsoft Windows contain multiple vulnerabilities, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.


Indeo is a video codec that was developed by Intel and Microsoft. Multiple versions of the Indeo video codec are included with several versions of Windows, including Windows 2000, XP, and Server 2003. Each of the Indeo codecs that are provided with Microsoft Windows contains multiple vulnerabilities that can result in memory corruption. The vulnerable video codecs can be reached through a variety of APIs, including Video for Windows (VfW) or the more recent DirectShow API. Any application that uses these APIs may be vulnerable. For example, Windows Media Player, Internet Explorer, and Windows Explorer can be used as attack vectors.


By convincing a user to process specially-crafted Indeo video content, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. This can occur by viewing a web page with Internet Explorer, opening a media file with Windows Media Player, or simply by selecting a media file in Windows Explorer.


An official patch is not available to remediate this vulnerability. Please consider the following workarounds:

Apply an update

This vulnerability is mitigated by the updates specified in Microsoft Security Advisory (954157), which have been distributed through Microsoft's automatic updates system. The updates are provided by Microsoft Support article KB955759, which sets the AppCompat values to prevent Internet Explorer and Windows Media Player from using the Indeo codecs, and Microsoft Support article KB976138, which updates quartz.dll on Windows 2000 systems to limit the zones that can use the Indeo codecs (Windows XP and later already have the zone restriction). Note that even after installing these updates, some attack vectors, such as Windows Explorer, will still be open.

Unregister the Indeo codecs

Microsoft Support article KB954157 provides a "Fix it" utility to automatically unregister the Indeo codec files. This will prevent the vulnerable codecs from being used by any application unless the codecs are re-registered. This mitigation is more comprehensive than the above updates; however, it may negatively impact applications that require an Indeo codec.

Vendor Information


Intel Corporation Affected

Notified:  June 22, 2009 Updated: December 14, 2009



Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Microsoft Corporation Affected

Notified:  June 12, 2009 Updated: December 14, 2009



Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Please see:

Vendor References

CVSS Metrics

Group Score Vector
Base 9 AV:N/AC:M/Au:N/C:C/I:C/A:P
Temporal 7.7 E:POC/RL:W/RC:C
Environmental 7.7 CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND



This vulnerability was reported by Will Dormann of the CERT/CC.

This document was written by Will Dormann.

Other Information

CVE IDs: None
Severity Metric: 9.56
Date Public: 2009-12-08
Date First Published: 2009-12-14
Date Last Updated: 2012-03-28 14:47 UTC
Document Revision: 26

Sponsored by CISA.