Vulnerabilities > CVE-2010-0480 - Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Microsoft products
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
Multiple stack-based buffer overflows in the MPEG Layer-3 audio codecs in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allow remote attackers to execute arbitrary code via a crafted AVI file, aka "MPEG Layer-3 Audio Decoder Stack Overflow Vulnerability."
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| OS | 19 |
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Buffer Overflow via Environment Variables This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
- Overflow Buffers Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
- Client-side Injection-induced Buffer Overflow This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
- Filter Failure through Buffer Overflow In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
- MIME Conversion An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.
Exploit-Db
description MS10-026 Microsoft MPEG Layer-3 Audio Stack Based Overflow. CVE-2010-0480. Remote exploit for windows platform id EDB-ID:17659 last seen 2016-02-02 modified 2011-08-13 published 2011-08-13 reporter metasploit source https://www.exploit-db.com/download/17659/ title Microsoft MPEG Layer-3 Audio - Stack Based Overflow MS10-026 description MOAUB #24 - Microsoft MPEG Layer-3 Audio Decoder Division By Zero. CVE-2010-0480. Dos exploit for windows platform id EDB-ID:15096 last seen 2016-02-01 modified 2010-09-24 published 2010-09-24 reporter Abysssec source https://www.exploit-db.com/download/15096/ title Microsoft MPEG Layer-3 Audio Decoder - Division By Zero
Metasploit
| description | This module exploits a buffer overflow in l3codecx.ax while processing a AVI files with MPEG Layer-3 audio contents. The overflow only allows to overwrite with 0's so the three least significant bytes of EIP saved on stack are overwritten and shellcode is mapped using the .NET DLL memory technique pioneered by Alexander Sotirov and Mark Dowd. Please note on IE 8 targets, your malicious URL must be a trusted site in order to load the .Net control. |
| id | MSF:EXPLOIT/WINDOWS/BROWSER/MS10_026_AVI_NSAMPLESPERSEC |
| last seen | 2020-06-14 |
| modified | 1976-01-01 |
| published | 1976-01-01 |
| references | |
| reporter | Rapid7 |
| source | https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/windows/browser/ms10_026_avi_nsamplespersec.rb |
| title | MS10-026 Microsoft MPEG Layer-3 Audio Stack Based Overflow |
Msbulletin
| bulletin_id | MS10-026 |
| bulletin_url | |
| date | 2010-04-13T00:00:00 |
| impact | Remote Code Execution |
| knowledgebase_id | 977816 |
| knowledgebase_url | |
| severity | Critical |
| title | Vulnerability in Microsoft MPEG Layer-3 Codecs Could Allow Remote Code Execution |
Nessus
| NASL family | Windows : Microsoft Bulletins |
| NASL id | SMB_NT_MS10-026.NASL |
| description | The Microsoft MPEG Layer-3 (MP3) codecs have a buffer overflow vulnerability that is triggered by opening a specially crafted AVI file with an MP3 audio stream. A remote attacker could exploit this by tricking a user into opening a malicious AVI file, which would lead to arbitrary code execution. |
| last seen | 2020-06-01 |
| modified | 2020-06-02 |
| plugin id | 45513 |
| published | 2010-04-13 |
| reporter | This script is Copyright (C) 2010-2018 Tenable Network Security, Inc. |
| source | https://www.tenable.com/plugins/nessus/45513 |
| title | MS10-026: Vulnerability in Microsoft MPEG Layer-3 Codecs Could Allow Remote Code Execution (977816) |
Oval
| accepted | 2010-06-07T04:00:39.696-04:00 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| class | vulnerability | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| contributors |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| definition_extensions |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| description | Multiple stack-based buffer overflows in the MPEG Layer-3 audio codecs in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allow remote attackers to execute arbitrary code via a crafted AVI file, aka "MPEG Layer-3 Audio Decoder Stack Overflow Vulnerability." | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| family | windows | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| id | oval:org.mitre.oval:def:7441 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| status | accepted | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| submitted | 2010-03-13T13:00:00 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| title | MPEG Layer-3 Audio Decoder Stack Overflow Vulnerability | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| version | 72 |
Packetstorm
data source https://packetstormsecurity.com/files/download/93498/moaub-msmpeg.txt id PACKETSTORM:93498 last seen 2016-12-05 published 2010-09-06 reporter Abysssec source https://packetstormsecurity.com/files/93498/Month-Of-Abysssec-Undisclosed-Bugs-Microsoft-MPEG-Layer-3.html title Month Of Abysssec Undisclosed Bugs - Microsoft MPEG Layer-3 data source https://packetstormsecurity.com/files/download/103965/ms10_026_avi_nsamplespersec.rb.txt id PACKETSTORM:103965 last seen 2016-12-05 published 2011-08-13 reporter Javier G. Sanchez source https://packetstormsecurity.com/files/103965/MS10-026-Microsoft-MPEG-Layer-3-Audio-Stack-Based-Overflow.html title MS10-026 Microsoft MPEG Layer-3 Audio Stack Based Overflow
Seebug
bulletinFamily exploit description BUGTRAQ ID: 39303 CVE ID: CVE-2010-0480 Microsoft Windows是微软发布的非常流行的操作系统。 Windows中所使用的MP3编码解码器处理AVI媒体文件的方式中存在栈溢出漏洞。如果用户打开包含MP3音频流的特制的AVI文件，此漏洞可能允许远程执行代码。如果用户使用管理用户权限登录，成功利用此漏洞的攻击者便可完全控制受影响的系统。 Microsoft Windows XP SP3 Microsoft Windows XP SP2 Microsoft Windows Vista SP2 Microsoft Windows Vista SP1 Microsoft Windows Vista Microsoft Windows Server 2008 SP2 Microsoft Windows Server 2008 Microsoft Windows Server 2003 SP2 Microsoft Windows 2000SP4 临时解决方法： * 限制访问MP3音频编码解码器。 厂商补丁： Microsoft --------- Microsoft已经为此发布了一个安全公告（MS10-026）以及相应补丁: MS10-026：Vulnerability in Microsoft MPEG Layer-3 Codecs Could Allow Remote Code Execution (977816) 链接：http://www.microsoft.com/technet/security/bulletin/MS10-026.mspx?pf=true id SSV:19458 last seen 2017-11-19 modified 2010-04-14 published 2010-04-14 reporter Root title Microsoft Windows MP3音频解码器栈溢出漏洞（MS10-026） bulletinFamily exploit description No description provided by source. id SSV:20848 last seen 2017-11-19 modified 2011-08-14 published 2011-08-14 reporter Root source https://www.seebug.org/vuldb/ssvid-20848 title MS10-026 Microsoft MPEG Layer-3 Audio Stack Based Overflow bulletinFamily exploit description No description provided by source. id SSV:20094 last seen 2017-11-19 modified 2010-09-06 published 2010-09-06 reporter Root source https://www.seebug.org/vuldb/ssvid-20094 title Microsoft MPEG Layer-3 Remote Command Execution Exploit bulletinFamily exploit description No description provided by source. id SSV:69775 last seen 2017-11-19 modified 2014-07-01 published 2014-07-01 reporter Root source https://www.seebug.org/vuldb/ssvid-69775 title Microsoft MPEG Layer-3 - Remote Command Execution Exploit
References
- http://securityreason.com/securityalert/8336
- http://securityreason.com/securityalert/8336
- http://www.us-cert.gov/cas/techalerts/TA10-103A.html
- http://www.us-cert.gov/cas/techalerts/TA10-103A.html
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-026
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-026
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7441
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7441