Multiple Buffer Overruns in Microsoft DirectX

Reported July 23, 2003, by Microsoft.

VERSIONS AFFECTED

DESCRIPTION

Two buffer-overrun vulnerabilities in Microsoft DirectX can result in the execution of arbitrary code on the vulnerable computer. This vulnerability stems from a pair of flaws in all versions of quartz.dll, which lets Windows applications play MIDI music through a common interface. An attacker can construct a malicious .mid file and configure it to play automatically whenever a victim attempts to view certain HTML, such as an attacker-controlled Web site, resulting in the compromise of the victim's machine. For detailed information about this vulnerability, see the discoverer's Web site.

VENDOR RESPONSE

Microsoft has released Security BulletinMS03-030, "Unchecked Buffer in DirectX Could Enable System Compromise (819696)," to address this vulnerability and recommends that affected users immediately apply the patch mentioned in the bulletin.

CREDIT

Discovered byeEye Digital Security.