{"vuid":"VU#561284","idnumber":"561284","name":"Microsoft Windows DirectX MIDI library does not adequately validate Text or Copyright parameters in MIDI files","keywords":["Microsoft","Windows","DirectX","buffer overflow","DirectShow","validate parameters","Musical Instrument Digital Interface","MIDI","Q819696","MS03-030","quartz.dll"],"overview":"A Microsoft Windows DirectX library, quartz.dll, does not properly validate certain parameters in Musical Instrument Digital Interface (MIDI) files. An attacker could exploit this vulnerability to execute arbitrary code or crash any application using the library, causing a denial of service.","clean_desc":"Microsoft Windows operating systems includes multimedia technologies called DirectX and DirectShow. From MS03-030, DirectX consists of a set of low-level Application Programming Interfaces (APIs) that are used by Windows programs for multimedia support. Within DirectX, the DirectShow technology performs client-side audio and video sourcing, manipulation, and rendering. DirectShow support for MIDI files is implemented in a library called quartz.dll. This library does not adequately validate the Text or Copyright parameters in MIDI files. As a result, a specially crafted MIDI file could cause an integer overflow, leading to heap memory corruption. Further technical details are available in eEye Digital Security advisory AD20030723. Any application that uses DirectX/DirectShow to process MIDI files could be affected by this vulnerability. Of particular concern, Internet Explorer (IE) loads the vulnerable library to process MIDI files embedded in HTML documents. An attacker could therefore exploit this vulnerability by convincing a victim to view an HTML document (web page, HTML email message) containing an embedded MIDI file. Note that a number of applications (Outlook, Outlook Express, Eudora, AOL, Lotus Notes, Adobe PhotoDeluxe, others) use the IE HTML rendering engine (WebBrowser ActiveX control) to interpret HTML documents. A similar vulnerability in quartz.dll is documented in VU#265232.","impact":"By convincing a victim to access a specially crafted MIDI or HTML file, an attacker could execute arbitrary code with the privileges of the victim. The attacker could also cause a denial of service in any\napplication that uses the vulnerable library.","resolution":"Apply a patch or upgrade\nApply the appropriate patch as referenced in Microsoft Security Bulletin MS03-030. The updated library (quartz.dll) is included in DirectX 9.0b and Service Pack 4 for Windows 2000.","workarounds":"Modify IE settings It is possible to significantly limit the ability of IE to automatically load MIDI files from HTML documents by making all of the following modifications: Disable Active scripting\nDisable Run ActiveX controls and plug-ins (stops <EMBED src=x.mid>)\nDisable Play sounds in web pages (stops <BGSOUND src=x.mid>)\nDisable Play videos in web pages (stops <IMG dynsrc=x.mid>)\nThe only complete solution for these vulnerabilities is to apply the patch. For example, Outlook Express 6 SP1 will play a MIDI file in an HTML email message regardless of the settings for audio and video in web pages. There may be other methods to automatically load a MIDI file from an HTML document. Also, these modifications will prevent some web pages from functioning properly.","sysaffected":"","thanks":"This vulnerability was reported by eEye Digital Security. Information from eEye Digital Security advisory \nAD20030723 and Microsoft Security Bulletin \nMS03-030 was used to write this document.","author":"This document was written by Art Manion.","public":["http://www.eeye.com/html/Research/Advisories/AD20030723.html","http://www.microsoft.com/technet/security/bulletin/MS03-030.asp","http://support.microsoft.com/default.aspx?scid=kb;en-us;819696"],"cveids":["CVE-2003-0346"],"certadvisory":"CA-2003-18","uscerttechnicalalert":null,"datecreated":"2003-07-23T20:53:01Z","publicdate":"2003-07-23T00:00:00Z","datefirstpublished":"2003-07-24T22:26:50Z","dateupdated":"2003-07-30T17:12:33Z","revision":33,"vrda_d1_directreport":"","vrda_d1_population":"","vrda_d1_impact":"","cam_widelyknown":"15","cam_exploitation":"0","cam_internetinfrastructure":"9","cam_population":"17","cam_impact":"13","cam_easeofexploitation":"15","cam_attackeraccessrequired":"20","cam_scorecurrent":"29.835","cam_scorecurrentwidelyknown":"36.050625","cam_scorecurrentwidelyknownexploited":"60.913125","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":29.835,"vulnote":null}