CVE-2007-0064

Current Description

Heap-based buffer overflow in Windows Media Format Runtime 7.1, 9, 9.5, 9.5 x64 Edition, 11, and Windows Media Services 9.1 for Microsoft Windows 2000, XP, Server 2003, and Vista allows user-assisted remote attackers to execute arbitrary code via a crafted Advanced Systems Format (ASF) file.

Basic Data

Published	December 12, 2007
Last Modified	October 30, 2018
Assigner	cve@mitre.org
Data Type	CVE
Data Format	MITRE
Data Version	4.0
Problem Type	CWE-119
CVE Data Version	4.0

Base Metric V2

CVSS 2 - Version	2.0
CVSS 2 - Vector String	AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS 2 - Access Vector	NETWORK
CVSS 2 - Access Complexity	MEDIUM
CVSS 2 - Authentication	NONE
CVSS 2 - Confidentiality Impact	COMPLETE
CVSS 2 - Availability Impact	COMPLETE
CVSS 2 - Base Score	9.3
Severity	HIGH
Exploitability Score	8.6
Impact Score	10.0
Obtain All Privilege	true
Obtain User Privilege	false
Obtain Other Privilege	false

Base Metric V3

No data provided.

Configurations

AND

OR - Configuration 1

Cpe Version	Part	Vendor	Product	Version	Update	Edition	Language	SW Edition	Target SW	Target HW	Other	Version Start Including	Version End Including	Version Start Excluding	Version End Excluding
2.3	OS	Microsoft	Windows 2000	*	sp4	*	*	*	*	*	*

OR Running on/with:

Cpe Version	Part	Vendor	Product	Version	Update	Edition	Language	SW Edition	Target SW	Target HW	Other	Version Start Including	Version End Including	Version Start Excluding	Version End Excluding
2.3	Application	Microsoft	Windows Media Format Runtime	7.1	*	*	*	*	*	*	*

AND

OR - Configuration 2

Cpe Version	Part	Vendor	Product	Version	Update	Edition	Language	SW Edition	Target SW	Target HW	Other	Version Start Including	Version End Including	Version Start Excluding	Version End Excluding
2.3	OS	Microsoft	Windows 2000	*	sp4	*	*	*	*	*	*
2.3	OS	Microsoft	Windows Xp	*	sp2	*	*	*	*	*	*

OR Running on/with:

Cpe Version	Part	Vendor	Product	Version	Update	Edition	Language	SW Edition	Target SW	Target HW	Other	Version Start Including	Version End Including	Version Start Excluding	Version End Excluding
2.3	Application	Microsoft	Windows Media Format Runtime	9	*	*	*	*	*	*	*

AND

OR - Configuration 3

Cpe Version	Part	Vendor	Product	Version	Update	Edition	Language	SW Edition	Target SW	Target HW	Other
2.3	OS	Microsoft	Windows 2003 Server	*	*	x64	*	*	*	*	*
2.3	OS	Microsoft	Windows 2003 Server	*	sp1	*	*	*	*	*	*
2.3	OS	Microsoft	Windows 2003 Server	*	sp2	*	*	*	*	*	*
2.3	OS	Microsoft	Windows 2003 Server	*	sp2	x64	*	*	*	*	*
2.3	OS	Microsoft	Windows Xp	*	*	x64	*	*	*	*	*
2.3	OS	Microsoft	Windows Xp	*	sp2	*	*	*	*	*	*
2.3	OS	Microsoft	Windows Xp	*	sp2	x64	*	*	*	*	*

OR Running on/with:

Cpe Version	Part	Vendor	Product	Version	Update	Edition	Language	SW Edition	Target SW	Target HW	Other	Version Start Including	Version End Including	Version Start Excluding	Version End Excluding
2.3	Application	Microsoft	Windows Media Format Runtime	9.5	*	*	*	*	*	*	*

AND

OR - Configuration 4

Cpe Version	Part	Vendor	Product	Version	Update	Edition	Language	SW Edition	Target SW	Target HW	Other
2.3	OS	Microsoft	Windows 2003 Server	*	*	x64	*	*	*	*	*
2.3	OS	Microsoft	Windows 2003 Server	*	sp2	x64	*	*	*	*	*
2.3	OS	Microsoft	Windows Xp	*	*	x64	*	*	*	*	*
2.3	OS	Microsoft	Windows Xp	*	sp2	x64	*	*	*	*	*

OR Running on/with:

Cpe Version	Part	Vendor	Product	Version	Update	Edition	Language	SW Edition	Target SW	Target HW	Other	Version Start Including	Version End Including	Version Start Excluding	Version End Excluding
2.3	Application	Microsoft	Windows Media Format Runtime	9.5	*	x64	*	*	*	*	*

AND

OR - Configuration 5

Cpe Version	Part	Vendor	Product	Version	Update	Edition	Language	SW Edition	Target SW	Target HW	Other
2.3	OS	Microsoft	Windows Vista	*	*	x64	*	*	*	*	*
2.3	OS	Microsoft	Windows Vista	-	*	*	*	*	*	*	*
2.3	OS	Microsoft	Windows Xp	*	*	x64	*	*	*	*	*
2.3	OS	Microsoft	Windows Xp	*	sp2	*	*	*	*	*	*
2.3	OS	Microsoft	Windows Xp	*	sp2	x64	*	*	*	*	*

OR Running on/with:

Cpe Version	Part	Vendor	Product	Version	Update	Edition	Language	SW Edition	Target SW	Target HW	Other	Version Start Including	Version End Including	Version Start Excluding	Version End Excluding
2.3	Application	Microsoft	Windows Media Format Runtime	11	*	*	*	*	*	*	*

AND

OR - Configuration 6

Cpe Version	Part	Vendor	Product	Version	Update	Edition	Language	SW Edition	Target SW	Target HW	Other
2.3	OS	Microsoft	Windows 2003 Server	*	*	x64	*	*	*	*	*
2.3	OS	Microsoft	Windows 2003 Server	*	sp1	*	*	*	*	*	*
2.3	OS	Microsoft	Windows 2003 Server	*	sp2	*	*	*	*	*	*
2.3	OS	Microsoft	Windows 2003 Server	*	sp2	x64	*	*	*	*	*

OR Running on/with:

Cpe Version	Part	Vendor	Product	Version	Update	Edition	Language	SW Edition	Target SW	Target HW	Other	Version Start Including	Version End Including	Version Start Excluding	Version End Excluding
2.3	Application	Microsoft	Windows Media Services	9.1	*	*	*	*	*	*	*

Vulnerable Software List

Vendor	Product	Versions
Microsoft	Windows Media Services	9.1
Microsoft	Windows Media Format Runtime	11, 7.1, 9, 9.5

References

Name	Source	URL	Tags
28034	http://secunia.com/advisories/28034	SECUNIA	Vendor Advisory
VU#319385	http://www.kb.cert.org/vuls/id/319385	CERT-VN	US Government Resource
SSRT071506	http://www.securityfocus.com/archive/1/485268/100/0/threaded	HP
26776	http://www.securityfocus.com/bid/26776	BID
1019074	http://www.securitytracker.com/id?1019074	SECTRACK
TA07-345A	http://www.us-cert.gov/cas/techalerts/TA07-345A.html	CERT	US Government Resource
ADV-2007-4183	http://www.vupen.com/english/advisories/2007/4183	VUPEN	Vendor Advisory
MS07-068	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-068	MS
oval:org.mitre.oval:def:3622	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3622	OVAL