CVE-2009-1537

Severity Score

9.3

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted QuickTime media file, as exploited in the wild in May 2009, aka "DirectX NULL Byte Overwrite Vulnerability."

Vulnerailidad sin especificar en el filtro QuickTime Movie Parser en quartz.dll en DirectShow en Microsoft DirectX v7.0 hasta v9.0c en Windows 2000 SP4, Windows XP SP2 y SP3, y Windows Server 2003 SP2 permite a atacantes remotos ejecutar código de su elección a través de un fichero multimedia QuickTime manipulado, como se ha explotado libremente en Mayo de 2009.

*Credits: N/A

CVSS Scores

NISTv2 9.3

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2009-05-05 CVE Reserved
2009-05-29 CVE Published
2024-08-07 CVE Updated
2024-11-01 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (13)

URL	Tag	Source
http://blogs.technet.com/srd/archive/2009/05/28/new-vulnerability-in-quicktime-parsing.aspx	X_refsource_confirm
http://isc.sans.org/diary.html?storyid=6481	X_refsource_misc
http://osvdb.org/54797	Vdb Entry
http://www.securityfocus.com/bid/35139	Vdb Entry
http://www.securitytracker.com/id?1022299	Vdb Entry
http://www.us-cert.gov/cas/techalerts/TA09-195A.html	Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6237	Signature

URL	Date	SRC

URL	Date	SRC
http://www.microsoft.com/technet/security/advisory/971778.mspx	2019-02-26

URL	Date	SRC
http://blogs.technet.com/msrc/archive/2009/05/28/microsoft-security-advisory-971778-vulnerability-in-microsoft-directshow-released.aspx	2019-02-26
http://secunia.com/advisories/35268	2019-02-26
http://www.vupen.com/english/advisories/2009/1445	2019-02-26
http://www.vupen.com/english/advisories/2009/1886	2019-02-26
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028	2019-02-26

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	7.0 Search vendor "Microsoft" for product "Directx" and version "7.0"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows 2000 Search vendor "Microsoft" for product "Windows 2000"	*	sp4	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	7.0a Search vendor "Microsoft" for product "Directx" and version "7.0a"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows 2000 Search vendor "Microsoft" for product "Windows 2000"	*	sp4	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	7.1 Search vendor "Microsoft" for product "Directx" and version "7.1"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows 2000 Search vendor "Microsoft" for product "Windows 2000"	*	sp4	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	8.1 Search vendor "Microsoft" for product "Directx" and version "8.1"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows 2000 Search vendor "Microsoft" for product "Windows 2000"	*	sp4	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	8.1b Search vendor "Microsoft" for product "Directx" and version "8.1b"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows 2000 Search vendor "Microsoft" for product "Windows 2000"	*	sp4	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0 Search vendor "Microsoft" for product "Directx" and version "9.0"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows 2000 Search vendor "Microsoft" for product "Windows 2000"	*	sp4	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0a Search vendor "Microsoft" for product "Directx" and version "9.0a"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows 2000 Search vendor "Microsoft" for product "Windows 2000"	*	sp4	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0b Search vendor "Microsoft" for product "Directx" and version "9.0b"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows 2000 Search vendor "Microsoft" for product "Windows 2000"	*	sp4	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0c Search vendor "Microsoft" for product "Directx" and version "9.0c"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows 2000 Search vendor "Microsoft" for product "Windows 2000"	*	sp4	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0 Search vendor "Microsoft" for product "Directx" and version "9.0"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows 2000 Search vendor "Microsoft" for product "Windows 2000"	*	sp4	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0 Search vendor "Microsoft" for product "Directx" and version "9.0"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows 2003 Server Search vendor "Microsoft" for product "Windows 2003 Server"	*	sp2	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0 Search vendor "Microsoft" for product "Directx" and version "9.0"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows 2003 Server Search vendor "Microsoft" for product "Windows 2003 Server"	*	sp2, itanium	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0 Search vendor "Microsoft" for product "Directx" and version "9.0"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows 2003 Server Search vendor "Microsoft" for product "Windows 2003 Server"	*	sp2, x64	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0 Search vendor "Microsoft" for product "Directx" and version "9.0"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Server 2003 Search vendor "Microsoft" for product "Windows Server 2003"	*	sp2	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0 Search vendor "Microsoft" for product "Directx" and version "9.0"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Xp Search vendor "Microsoft" for product "Windows Xp"	*	sp2	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0 Search vendor "Microsoft" for product "Directx" and version "9.0"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Xp Search vendor "Microsoft" for product "Windows Xp"	*	sp2, professional_x64	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0 Search vendor "Microsoft" for product "Directx" and version "9.0"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Xp Search vendor "Microsoft" for product "Windows Xp"	*	sp3	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0a Search vendor "Microsoft" for product "Directx" and version "9.0a"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows 2000 Search vendor "Microsoft" for product "Windows 2000"	*	sp4	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0a Search vendor "Microsoft" for product "Directx" and version "9.0a"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows 2003 Server Search vendor "Microsoft" for product "Windows 2003 Server"	*	sp2	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0a Search vendor "Microsoft" for product "Directx" and version "9.0a"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows 2003 Server Search vendor "Microsoft" for product "Windows 2003 Server"	*	sp2, itanium	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0a Search vendor "Microsoft" for product "Directx" and version "9.0a"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows 2003 Server Search vendor "Microsoft" for product "Windows 2003 Server"	*	sp2, x64	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0a Search vendor "Microsoft" for product "Directx" and version "9.0a"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Server 2003 Search vendor "Microsoft" for product "Windows Server 2003"	*	sp2	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0a Search vendor "Microsoft" for product "Directx" and version "9.0a"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Xp Search vendor "Microsoft" for product "Windows Xp"	*	sp2	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0a Search vendor "Microsoft" for product "Directx" and version "9.0a"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Xp Search vendor "Microsoft" for product "Windows Xp"	*	sp2, professional_x64	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0a Search vendor "Microsoft" for product "Directx" and version "9.0a"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Xp Search vendor "Microsoft" for product "Windows Xp"	*	sp3	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0b Search vendor "Microsoft" for product "Directx" and version "9.0b"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows 2000 Search vendor "Microsoft" for product "Windows 2000"	*	sp4	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0b Search vendor "Microsoft" for product "Directx" and version "9.0b"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows 2003 Server Search vendor "Microsoft" for product "Windows 2003 Server"	*	sp2	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0b Search vendor "Microsoft" for product "Directx" and version "9.0b"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows 2003 Server Search vendor "Microsoft" for product "Windows 2003 Server"	*	sp2, itanium	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0b Search vendor "Microsoft" for product "Directx" and version "9.0b"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows 2003 Server Search vendor "Microsoft" for product "Windows 2003 Server"	*	sp2, x64	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0b Search vendor "Microsoft" for product "Directx" and version "9.0b"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Server 2003 Search vendor "Microsoft" for product "Windows Server 2003"	*	sp2	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0b Search vendor "Microsoft" for product "Directx" and version "9.0b"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Xp Search vendor "Microsoft" for product "Windows Xp"	*	sp2	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0b Search vendor "Microsoft" for product "Directx" and version "9.0b"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Xp Search vendor "Microsoft" for product "Windows Xp"	*	sp2, professional_x64	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0b Search vendor "Microsoft" for product "Directx" and version "9.0b"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Xp Search vendor "Microsoft" for product "Windows Xp"	*	sp3	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0c Search vendor "Microsoft" for product "Directx" and version "9.0c"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows 2000 Search vendor "Microsoft" for product "Windows 2000"	*	sp4	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0c Search vendor "Microsoft" for product "Directx" and version "9.0c"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows 2003 Server Search vendor "Microsoft" for product "Windows 2003 Server"	*	sp2	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0c Search vendor "Microsoft" for product "Directx" and version "9.0c"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows 2003 Server Search vendor "Microsoft" for product "Windows 2003 Server"	*	sp2, itanium	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0c Search vendor "Microsoft" for product "Directx" and version "9.0c"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows 2003 Server Search vendor "Microsoft" for product "Windows 2003 Server"	*	sp2, x64	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0c Search vendor "Microsoft" for product "Directx" and version "9.0c"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Server 2003 Search vendor "Microsoft" for product "Windows Server 2003"	*	sp2	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0c Search vendor "Microsoft" for product "Directx" and version "9.0c"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Xp Search vendor "Microsoft" for product "Windows Xp"	*	sp2	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0c Search vendor "Microsoft" for product "Directx" and version "9.0c"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Xp Search vendor "Microsoft" for product "Windows Xp"	*	sp2, professional_x64	Affected
Microsoft Search vendor "Microsoft"	Directx Search vendor "Microsoft" for product "Directx"	9.0c Search vendor "Microsoft" for product "Directx" and version "9.0c"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Xp Search vendor "Microsoft" for product "Windows Xp"	*	sp3	Affected