Software Engineering Institute

According to Microsoft, the Windows Media Encoder is a tool used to capture audio and video content using Windows Media. The WMEX.DLL ActiveX control contains a buffer overflow vulnerability.

By convincing a user to view a specially crafted web page, an attacker may be able to execute arbitrary code with the privileges of the user.

Apply an update

Microsoft has published Microsoft Security Bulletin MS08-053 in response to this issue.

Disable WMEX.DLL in Internet Explorer

According to Microsoft Security Bulletin MS08-053, administrators can set the kill bit for WMEX.DLL.

Do not allow access to WMEX.DLL

Administrators can deny access to WMEX.DLL in Windows 2000, Windows XP, and Windows Server 2003 by running the following command in an administrative command prompt:

Echo y| cacls "C:\Program Files\Windows Media Components\Encoder\wmex.dll" /E /P everyone:N

The same can be done with Windows Vista and Server 2008 by running

Takeown.exe /f "C:\Program Files\Windows Media Components\Encoder\wmex.dll"
Icacls.exe "C:\Program Files\Windows Media Components\Encoder\wmex.dll" /save %TEMP%\WMEX_ACL.TXT
Icacls.exe "C:\Program Files\Windows Media Components\Encoder\wmex.dll" /deny everyone:(F)

Unregister WMEX.DLL

Administrators can unregister WMEX.DLL by running the following command in an administrative command prompt:

regsvr32.exe -u "C:\Program Files\Windows Media Components\Encoder\wmex.dll