{"vuid":"VU#996227","idnumber":"996227","name":"Windows Media Encoder WMEX.DLL ActiveX Control buffer overflow","keywords":["Windows Media Encoder","buffer overflow","remote code execution","WMEX.DLL ActiveX control","ms08-sep"],"overview":"The WMEX.DLL ActiveX control, which is installed by Windows Media Encoder 9 Series, contains a buffer overflow vulnerability.","clean_desc":"According to Microsoft, the Windows Media Encoder is a tool used to capture audio and video content using Windows Media. The WMEX.DLL ActiveX control contains a buffer overflow vulnerability.","impact":"By convincing a user to view a specially crafted web page, an attacker may be able to execute arbitrary code with the privileges of the user.","resolution":"Apply an update\nMicrosoft has published Microsoft Security Bulletin MS08-053 in response to this issue.","workarounds":"Disable WMEX.DLL in Internet Explorer According to Microsoft Security Bulletin MS08-053, administrators can set the kill bit for WMEX.DLL. Do not allow access to WMEX.DLL Administrators can deny access to WMEX.DLL in Windows 2000, Windows XP, and Windows Server 2003 by running the following command in an administrative command prompt: Echo y| cacls \"C:\\Program Files\\Windows Media Components\\Encoder\\wmex.dll\" /E /P everyone:N The same can be done with Windows Vista and Server 2008 by running Takeown.exe /f \"C:\\Program Files\\Windows Media Components\\Encoder\\wmex.dll\" \nIcacls.exe \"C:\\Program Files\\Windows Media Components\\Encoder\\wmex.dll\" /save %TEMP%\\WMEX_ACL.TXT \nIcacls.exe \"C:\\Program Files\\Windows Media Components\\Encoder\\wmex.dll\" /deny everyone:(F) Unregister WMEX.DLL Administrators can unregister WMEX.DLL by running the following command in an administrative command prompt: regsvr32.exe -u \"C:\\Program Files\\Windows Media Components\\Encoder\\wmex.dll","sysaffected":"","thanks":"Microsoft credits Nguyen Minh Duc and Le Manh Tung, with \nBach Khoa Internetwork Security Center (BKIS), \nHanoi University of Technology (Vietnam)\n,  for reporting this vulnerability.","author":"This document was written by John Hollenberger.","public":["http://www.microsoft.com/technet/security/bulletin/ms08-Sep.mspx","http://www.microsoft.com/technet/security/bulletin/ms08-053.mspx","http://secunia.com/advisories/31724/"],"cveids":["CVE-2008-3008"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2008-09-09T17:04:17Z","publicdate":"2008-09-09T00:00:00Z","datefirstpublished":"2008-09-09T18:36:38Z","dateupdated":"2008-10-02T20:23:09Z","revision":17,"vrda_d1_directreport":"0","vrda_d1_population":"4","vrda_d1_impact":"3","cam_widelyknown":"15","cam_exploitation":"10","cam_internetinfrastructure":"10","cam_population":"15","cam_impact":"19","cam_easeofexploitation":"12","cam_attackeraccessrequired":"20","cam_scorecurrent":"44.8875","cam_scorecurrentwidelyknown":"51.3","cam_scorecurrentwidelyknownexploited":"64.125","ipprotocol":"","cvss_accessvector":"--","cvss_accesscomplexity":"--","cvss_authentication":null,"cvss_confidentialityimpact":"--","cvss_integrityimpact":"--","cvss_availabilityimpact":"--","cvss_exploitablity":null,"cvss_remediationlevel":"ND","cvss_reportconfidence":"ND","cvss_collateraldamagepotential":"ND","cvss_targetdistribution":"ND","cvss_securityrequirementscr":"ND","cvss_securityrequirementsir":"ND","cvss_securityrequirementsar":"ND","cvss_basescore":"0","cvss_basevector":"AV:--/AC:--/Au:--/C:--/I:--/A:--","cvss_temporalscore":"0","cvss_environmentalscore":"0","cvss_environmentalvector":"CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND","metric":44.8875,"vulnote":null}