SB2020060925 - Multiple vulnerabilities in Microsoft Media Foundation

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Out-of-bounds read (CVE-ID: CVE-2020-1232)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary condition within Microsoft Windows Media Player when parsing DTS streams. A remote attacker can trick the victim into connection to a malicious streaming server, trigger an out-of-bounds read error and read contents of memory on the system.

2) Out-of-bounds write (CVE-ID: CVE-2020-1238)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in Windows Media Foundation. A remote attacker can trick a victim to open a specially crafted document, or visit a malicious webpage, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

3) Integer underflow (CVE-ID: CVE-2020-1239)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer underflow in mpg2splt.ax module of Windows Media Player. A remote attacker can ass specially crafted data to the application, trigger integer underflow and execute arbitrary code on the target system.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1232
• https://www.zerodayinitiative.com/advisories/ZDI-20-693/
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1238
• https://www.zerodayinitiative.com/advisories/ZDI-20-695/
• https://www.zerodayinitiative.com/advisories/ZDI-20-696/
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1239
• https://www.zerodayinitiative.com/advisories/ZDI-20-697/