Alert GCSA-09055 - Vulnerabilita' in Microsoft DirectShow (MS09-028)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


******************************************************************

     Alert ID : GCSA-09055
         Data : 15 Luglio 2009
       Titolo : Vulnerabilita' in Microsoft DirectShow (MS09-028)

******************************************************************

:: Descrizione del problema

Sono state riscontrate vulnerabilita' multiple in Microsoft Windows e DirectX,
che potrebbero essere sfruttate per compromettere un sitema vulnerabile.

Tali vulnerabilita' sono causate da errori presenti nel componente DirectShow,
e potrebbero permettere l'esecuzione remota di codice arbitrario.


:: Software interessato

Microsoft Windows 2000 Service Pack 4
Microsoft Windows 2000 Service Pack 4
Microsoft Windows 2000 Service Pack 4
Microsoft Windows XP Service Pack 2
Microsoft Windows XP Service Pack 3
Microsoft Windows XP Professional x64 Edition Service Pack 2
Microsoft Windows Server 2003 Service Pack 2
Microsoft Windows Server 2003 x64 Edition Service Pack 2
Microsoft Windows Server 2003 SP2 (Itanium)
Microsoft DirectX 7.0
Microsoft DirectX 8.1
Microsoft DirectX 9.0


:: Impatto

Esecuzione remota di codice arbitrario
Possibile compromissione del sistema


:: Soluzioni

Applicare gli aggiornamenti rilasciati da Microsoft:
http://www.microsoft.com/technet/security/Bulletin/MS09-028.mspx


:: Riferimenti

Microsoft Security Bulletin MS09-028
http://www.microsoft.com/technet/security/Bulletin/MS09-028.mspx

US-CERT - Technical Cyber Security Alert TA09-160A
http://www.us-cert.gov/cas/techalerts/TA09-195A.html

VuPEN
http://www.vupen.com/english/advisories/2009/1886

Mitre's CVE ID
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1537
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1538
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1539

-----BEGIN PGP SIGNATURE-----

iQCVAwUBSl2xUfOB+SpikaiRAQI4CgP/eUVKw47hu3gWN5l33WOR+C6nlf6Hs7qD
MOggSwTH553NDazhjO61hXMb1sSiE7kc6/KUoQlgLwrQBx2H1oI41uCs/ZAfsvAe
PcXO2HeDIAhJ97F9JDaamOUApP9ZuGqD3H1hIsZk9EAalT2n0Qv5f3WR7VMtnTTp
FOUZAhTwjLQ=
=kJoZ
-----END PGP SIGNATURE-----