Microsoft Security Bulletin MS10-050 - Important

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in your situation:

• In a Web-based attack scenario, an attacker could host a Web site that contains a Web page that is used to exploit this vulnerability. In addition, compromised Web sites and Web sites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit this vulnerability. In all cases, however, an attacker would have no way to force users to visit these Web sites. Instead, an attacker would have to convince users to visit the Web site, typically by getting them to click a link in an e-mail message or Instant Messenger message that takes users to the attacker's Web site.
• The specially crafted file could be sent as an e-mail attachment, but the attacker would have to convince the user to open the attachment in order to exploit the vulnerability.
• An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Workaround refers to a setting or configuration change that does not correct the underlying vulnerability but would help block known attack vectors before you apply the update. Microsoft has tested the following workarounds and states in the discussion whether a workaround reduces functionality:

• Remove the Movie Maker .MSWMM file association

  Note See Microsoft Knowledge Base Article 981997 to use the automated Microsoft Fix it solution to enable or disable this workaround. This Fix it solution deploys the workaround, and thus has the same user impact. We recommend that administrators review the KB article closely prior to deploying this Fix it solution.

  Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use the Registry Editor at your own risk. For information about how to edit the registry, view the "Changing Keys and Values" Help topic in Registry Editor (Regedit.exe) or view the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe.

  Note We recommend backing up the registry before you edit it.

  To remove the Movie Maker .MSWMM file association, follow these steps:

  Interactive Method

  1. Click Start, click Run, type regedit, and then click OK.
  2. Expand HKEY_CLASSES_ROOT, click on .MSWMM, and then click the File menu and select Export.
  3. In the Export Registry File dialog box, type MSWMM file association registry backup.reg and click Save. This will create a backup of this registry key in the 'My Documents' folder by default.
  4. Press the Delete key on the keyboard to delete the registry key. When prompted to delete the registry value, click Yes.

  Managed Deployment Script

  1. Make a backup copy of the registry key using the following command:
     
     Regedit.exe /e MSWMM_registry_backup.reg HKEY_CLASSES_ROOT\.MSWMM
  2. Save the following to a file with a .REG extension (i.e., Delete_MSWMM_file_association.reg):
     
     Windows Registry Editor Version 5.00

[-HKEY_CLASSES_ROOT\.MSWMM]
  3. Run the registry script created in step 2 on the target machine with the following command:
     
     Regedit.exe /s Delete_MSWMM_file_association.reg

  Impact of workaround. This workaround removes the .MSWMM file association. Double-clicking an MSWMM file will no longer launch Windows Movie Maker.

  How to undo the workaround. Restore the registry key by using Regedit to restore the settings saved in the .REG file.

What is the scope of the vulnerability? 
This is a remote code execution vulnerability. An attacker who successfully exploited this vulnerability could take complete control of an affected system remotely. An attacker could then install programs or view, change, or delete data; or create new accounts with full user rights.

What causes the vulnerability? 
The vulnerability exists in the way that Windows Movie Maker parses the project file formats. This vulnerability requires a malicious user to send a specially crafted Movie Maker file and convince the user to open the specially crafted file.

What is Windows Movie Maker? 
Windows Movie Maker is an application that allows users to create, edit and add special effects to home movies. Windows Movie Maker is included with releases of Windows XP and Windows Vista.

What might an attacker use the vulnerability to do? 
An attacker who successfully exploited this vulnerability could run arbitrary code as the logged-on user. If a user is logged on with administrative user rights, an attacker could take complete control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

How could an attacker exploit the vulnerability? 
Exploitation of this vulnerability requires that a user open a specially crafted Movie Maker project file with an affected version of Windows Movie Maker.

In an e-mail attack scenario, an attacker could exploit the vulnerability by sending a specially crafted Movie Maker project file to the user and by convincing the user to open the file.

In a Web-based attack scenario, an attacker would have to host a Web site that contains a specially crafted Movie Maker project file that is used to attempt to exploit this vulnerability. In addition, compromised Web sites and Web sites that accept or host user-provided content could contain specially crafted content that could exploit this vulnerability. An attacker would have no way to force users to visit a specially crafted Web site. Instead, an attacker would have to convince them to visit the Web site, typically by getting them to click a link that takes them to the attacker's site, and then convince them to open the specially crafted Movie Maker project file.

What systems are primarily at risk from the vulnerability? 
Windows systems where Windows Movie Maker is used are primarily at risk.

What does the update do? 
The update addresses the vulnerability by changing the way that Windows Movie Maker parses Movie Maker project files.

When this security bulletin was issued, had this vulnerability been publicly disclosed? 
No. Microsoft received information about this vulnerability through coordinated vulnerability disclosure.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited? 
No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers when this security bulletin was originally issued.

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.

Note For supported versions of Windows XP Professional x64 Edition, this security update is the same as supported versions of the Windows Server 2003 x64 Edition security update.

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.