Microsoft Security Bulletin MS10-052 - Critical

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in your situation:

• An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
• In a Web-based attack scenario, an attacker could host a Web site that contains a Web page that is used to exploit this vulnerability. In addition, compromised Web sites and Web sites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit this vulnerability. In all cases, however, an attacker would have no way to force users to visit these Web sites. Instead, an attacker would have to convince users to visit the Web site, typically by getting them to click a link in an e-mail message or Instant Messenger message that takes users to the attacker’s Web site.
• The vulnerability cannot be exploited automatically through e-mail. For an attack to be successful, a user must open an attachment that is sent in an e-mail message.

Workaround refers to a setting or configuration change that does not correct the underlying vulnerability but would help block known attack vectors before you apply the update. Microsoft has tested the following workarounds and states in the discussion whether a workaround reduces functionality:

• Unregister l3codecx.ax

  On Windows XP and Windows Server 2003 systems, run the following commands from a command prompt.

  For 32-bit Windows:
  
  Regsvr32.exe –u %WINDIR%\system32\l3codecx.ax

  For 64-bit Windows:
  
  Regsvr32.exe –u %WINDIR%\syswow64\l3codecx.ax
  

  Impact of workaround. MPEG Layer-3 Parsing is disabled in applications that use DirectShow to play MPEG Layer-3 content.

  How to undo the workaround.

  On Windows XP and Windows Server 2003 systems, run the following commands from a command prompt.

  For 32-bit Windows:
  
  Regsvr32.exe %WINDIR%\system32\l3codecx.ax

  For 64-bit Windows:
  
  Regsvr32.exe %WINDIR%\syswow64\l3codecx.ax
  

• Deny access to l3codecx.ax

  On Windows XP and Windows Server 2003 systems run the following commands from a command prompt.

  For 32-bit Windows:
  
  cacls %WINDIR%\system32\l3codecx.ax /E /P everyone:N

  For 64-bit Windows:
  
  cacls %WINDIR%\syswow64\l3codecx.ax /E /P everyone:N
  

  Impact of workaround. MPEG Layer-3 Parsing is disabled in applications that use DirectShow to play MPEG Layer-3 content.

  How to undo the workaround.

  On Windows XP and Windows Server 2003 systems run the following commands from a command prompt.

  For 32-bit Windows:
  
  cacls %WINDIR%\system32\l3codecx.ax /E /R everyone

  For 64-bit Windows:
  
  cacls %WINDIR%\syswow64\l3codecx.ax /E /R everyone
  

• Disable MPEG Layer-3 parsing in DirectShow

  Removing the registry key specified below prevents MPEG Layer-3 parsing in applications that use DirectShow to play MPEG Layer-3 content.

  Note Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. For information about how to edit the registry, view the "Changing Keys And Values" Help topic in Registry Editor (Regedit.exe) or view the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe.

  Using the Interactive Method

  For 32-bit Windows systems:

  1. Click Start, click Run, type Regedit in the Open box, and then click OK.
  2. Locate the following subkey:
     
     HKEY_CLASSES_ROOT\CLSID\{38BE3000-DBF4-11D0-860E-00A024CFEF6D}
  3. On the File menu, click Export.
  4. In the Export Registry File dialog box, enter MP3_Parser_Backup.reg and click Save.
     
     Note This will create a backup of this registry key in the My Documents folder by default.
  5. Press the Delete key on the keyboard to delete the registry key. When prompted to delete the registry key via the Confirm Key Delete dialog box, click Yes.

  For 64-bit Windows systems:

  1. Click Start, click Run, type Regedit in the Open box, and then click OK.
  2. Locate the following subkey:
     
     HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{38BE3000-DBF4-11D0-860E-00A024CFEF6D}
  3. On the File menu, click Export.
  4. In the Export Registry File dialog box, enter MP3_Parser_Backup1.reg and click Save.
     
     Note This will create a backup of this registry key in the My Documents folder by default.
  5. Press the Delete key on the keyboard to delete the registry key. When prompted to delete the registry key via the Confirm Key Delete dialog box, click Yes.
  6. Click Start, click Run, type Regedit in the Open box, and then click OK.
  7. Locate the following subkey:
     
     HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{38BE3000-DBF4-11D0-860E-00A024CFEF6D}
  8. On the File menu, click Export.
  9. In the Export Registry File dialog box, enter MP3_Parser_Backup 2.reg and click Save.
     
     Note This will create a backup of this registry key in the My Documents folder by default.
  10. Press the Delete key on the keyboard to delete the registry key. When prompted to delete the registry key via the Confirm Key Delete dialog box, click Yes.

  Using a Managed Deployment Script

  1. Create a backup copy of the registry keys by using a managed deployment script that contains the following commands:
     
     For 32-bit Windows systems:
     
     Regedit.exe /e MP3_Parser_Backup.reg HKEY_CLASSES_ROOT\CLSID\{38BE3000-DBF4-11D0-860E-00A024CFEF6D}
     
     
     For 64-bit Windows Systems:
     
     Regedit.exe /e MP3_Parser_Backup.reg HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{38BE3000-DBF4-11D0-860E-00A024CFEF6D}
     
  2. Next, save the following to a file with a .REG extension, such as Disable_MP3_Parser.reg:
     
     For 32-bit Windows systems:
     
     Windows Registry Editor Version 5.00

[-HKEY_CLASSES_ROOT\CLSID\{38BE3000-DBF4-11D0-860E-00A024CFEF6D}]
     
     
     For 64-bit Windows Systems:
     
     Windows Registry Editor Version 5.00

[-HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{38BE3000-DBF4-11D0-860E-00A024CFEF6D}]
     
  3. Run the above registry script on the target machine with the following command from an elevated command prompt:
     
     Regedit.exe /s Disable_MP3_Parser.reg

  Impact of workaround. MPEG Layer-3 Parsing is disabled in applications that use DirectShow to play MPEG Layer-3 content.

  How to undo the workaround.

  Using the Interactive Method

  For 32-bit Windows systems:

  1. Click Start, click Run, type Regedit in the Open box, and then click OK.
  2. Click the File menu and select Import.
  3. In the Import Registry File dialog box, select MP3_Parser_Backup.reg and click Open.

  For 64-bit Windows systems:

  1. Click Start, click Run, type Regedit in the Open box, and then click OK.
  2. Click the File menu and select Import.
  3. In the Import Registry File dialog box, select MP3_Parser_Backup1.reg and click Open.
  4. In the Import Registry File dialog box, select MP3_Parser_Backup2.reg and click Open.

  Using a Managed Deployment Script

  For 32-bit Windows systems:

  Restore the original state by running the following command:
  
  Regedit.exe /s MP3_Parser_Backup.reg
  

  For 64-bit Windows systems:

  Restore the original state by running the following command:
  
  Regedit.exe /s MP3_Parser_Backup.reg
  

What is the scope of the vulnerability? 
This is a remote code execution vulnerability. An attacker who successfully exploited this vulnerability could take complete control of an affected system remotely. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

What causes the vulnerability? 
The Microsoft MPEG Layer-3 audio codecs do not properly handle specially crafted media files containing an MPEG Layer-3 audio stream.

What are Microsoft MPEG Layer-3 audio codecs? 
The vulnerable MPEG Layer-3 audio codecs are the MPEG Layer-3 Audio Codec for Microsoft DirectShow (l3codecx.ax). This MPEG Layer-3 audio codec is delivered as part of Windows Media and as a part of the Windows operating system.

What is DirectShow? 
DirectX consists of a set of low-level Application Programming Interfaces (APIs) used by Windows programs for multimedia support. Within DirectX, the DirectShow technology performs client-side audio and video sourcing, manipulation and rendering.

Microsoft DirectShow is used for streaming media on Microsoft Windows operating systems. DirectShow is used for high-quality capture and playback of multimedia streams. It automatically detects and uses video and audio acceleration hardware when available, but also supports systems without acceleration hardware. DirectShow is also integrated with other DirectX technologies. Some examples of applications that you can create using DirectShow include DVD players, video editing applications, AVI to ASF converters, MP3 players, and digital video capture applications.

What is MPEG-1 Audio Layer 3 (MP3)? 
MPEG-1 Audio Layer 3 is a file format that uses lossy compression to compress audio information. Lossy compression is a technique in which decompressed data may be different from the data initially compressed, but similar enough to be parsed and represented. It is common in audio applications such as streaming media.

What might an attacker use the vulnerability to do? 
If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

How could an attacker exploit the vulnerability? 
This vulnerability requires that a user open a specially crafted media file or receive specially crafted streaming content from a Web site or any application that delivers Web content.

In a Web-based attack scenario, an attacker would have to host a Web site that contains specially crafted content that is used to attempt to exploit this vulnerability. In addition, compromised Web sites and Web sites that accept or host user-provided content could contain specially crafted content that could exploit this vulnerability. An attacker would have no way to force users to visit a specially crafted Web site. Instead, an attacker would have to convince them to visit the Web site, typically by getting them to click a link in an e-mail message or Instant Messenger message that takes them to the attacker's site.

In an e-mail attack scenario, an attacker could exploit the vulnerability by sending a media file with a specially crafted media file embedded in it to the user and by convincing the user to open the file.

What systems are primarily at risk from the vulnerability? 
Workstations and terminal servers are primarily at risk. Servers could be at more risk if users who should not have sufficient administrative permissions are given the ability to log on to servers and to run programs. However, best practices strongly discourage allowing this.

What does the update do? 
The update addresses the issue by correcting the way that the Microsoft MPEG Layer-3 audio codecs handle the MPEG Layer-3 audio stream in specially crafted media files.

When this security bulletin was issued, had this vulnerability been publicly disclosed? 
No. Microsoft received information about this vulnerability through coordinated vulnerability disclosure.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited? 
No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers when this security bulletin was originally issued.

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.

Note For supported versions of Windows XP Professional x64 Edition, this security update is the same as supported versions of the Windows Server 2003 x64 Edition security update.

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.