Jump to content
The Inquirer-Home

Directshow has a fault

Microsoft warns
Friday, 29 May 2009, 13:40


DIRECTSHOW, a framework for playing various media types, is being exploited in the wild in older versions of Windows, Microsoft has warned.

In a statement, the Vole said that the attacks use malicious Quicktime media files and can cause remote code execution in the context of the logged-in user.

There is no patch for the vulnerability yet, but Microsoft has created a workaround registry script that you can download and run, at the Knowledge Base Article 971778.

The flaw apparently is in Directshow versions 7, 8 and 9 in Windows 2000, Windows XP and Windows Server 2003. Windows Vista, Windows Server 2008 and Windows 7 don't seem to have the problem. µ

Share this:

Comments
Stupid Apple

Quicktime has to be the most pointless video player in existence and now its hurting the Mighty Vole.

posted by : I know, 29 May 2009 Complain about this comment
Funny

It funny but over the years I have noticed that MS seems to find this kind of stuff just before they release a new OS. The new OS doesn't have the problem, hint, hint.
Another reason to us Linux or Mac if you got the cash.

posted by : Regulas, 29 May 2009 Complain about this comment
Come To Silver Light.....3.

Small Snip Stolen from theREG:

Microsoft on Thursday announced what it calls a launch event for Silverlight 3, and it's set for July 10.

Silver light 3 beta is WDK, or ?Write it Yourself, So its fast turnaround for developement this year.

Silver light 3 goes beyond Browser, Beyond H.264, beyong Shimer of Silverly Moon. Competes directly with adobe Flash & Java, Its another bunch o' small steps Up, for everyone with Windows. & Right After Boxing Day....

posted by : vondrashek, 29 May 2009 Complain about this comment
WHats funnier

Directshow support for quicktime files is very very limited and only QT6 and earlier.

posted by : Andy, 29 May 2009 Complain about this comment
Oh My MY

OH woe is me. Who do I give my $300 too. I hope MS doesn't find anymore flaws in their software. I mean I only have so much money to go around.
Looks like I'll have to take my Grandkids off my Christmas list. Maybe their birthdays too, just so I can give to MS and their flaws. I wish just once they would have a recall on their products. Maybe give me a discount if I turn in my old xp for the new Win7.

posted by : Uncle, 29 May 2009 Complain about this comment
VLC FTW

QuickTime is retarded, I don't even use it on my mac I use VLC

posted by : Dorktime, 29 May 2009 Complain about this comment
Does this kill QT playback?

So if you read the official MS documentation (http://support.microsoft.com/kb/971778) right down at the bottom they slipped this pithy little statement:

"Impact of the workaround - QuickTime content playback will be disabled."

Does it really mean this? I just ran this wonderful reg. hack on a XP SP3 workstation and afterwards a .MOV file played just fine, at least it did in QT Player. In WMP (v11) it played just the audio and gave an "Unknown error" about the video. However knowing WMP it may well have never worked properly. Plus I haven't rebooted yet and I can never figure when these Registry changes take effect.

posted by : Aunty Dan, 29 May 2009 Complain about this comment
Re: Aunty Dan

"The flaw apparently is in Directshow versions 7, 8 and 9 in Windows 2000"

You don't need to bother patching a machine with Windows XP SP3, they are not affected.

posted by : WG, 29 May 2009 Complain about this comment
@WG - XP SP3 IS Affected

But it's a simple enough fix:

http://support.microsoft.com/kb/971778

Tells you how.

posted by : Shadders, 29 May 2009 Complain about this comment
Microsoft just wants...

that everybody buy either Vista or 7 so they can make some more money.

posted by : Duke975, 29 May 2009 Complain about this comment
Not QT, DirectShow!

The bug is not in Apple's QuickTime, it's in Microsoft's DirectShow, damnit!

Can't anyone fucking read anymore?

QuickTime is a structured file format plus codecs, like AVI. Microsoft tried to parse the QT structures and screwed it, as usual.

But all is not lost. Microsoft emphasizes this is not a browser based bug, it's in DS. The browser is only an attack vector. Thanks Microsoft, I feel a lot safer now!

Vista is not in danger, probably because they removed their half-assed QuickTime implementation just-in-time.

Unfortunately, nobody uses Vista...

posted by : Wiseguy, 29 May 2009 Complain about this comment
Linux

Microsoft should release an MS version of linux, could you imagine, what a thought.....and don't laugh if there's money in it they'll do it.

posted by : Ed, 30 May 2009 Complain about this comment
Its DS... no its QT...no is DS..no it is QT!

Ok. Microsoft has had its fair share of stuff ups. But when you support software and hardware for the world+dog you cant be pointing the finger at MS all the time. The majority of these kinds of security and incompatibility faults reside from the INCORRECT IMPLEMENTATION of lazy, stupid coders who do not follow the clearly provided and defined API contexts. Not a fault in QT...a fault in its implementation...funny how selective this problem is...

When Apple actually INVENT something besides a better plastic box for IC's then i'll give them some cred. Fantastic marketing company but they can't always rely on the 80-90's glory days of Photoshop on a Mac.

posted by : Chazlow, 30 May 2009 Complain about this comment
Advertisement
Subscribe to the INQ Newsletter
Sign-up for the INQBot weekly newsletter
Click here to sign up Existing user
Advertisement
INQ Poll

Windows 7 impressions

How is windows 7 working out for you?