Sign in with
Sign up | Sign in

Microsoft Warns About DirectX Exploit

By - Source: Tom's Hardware US | B 17 comments

Yesterday, the "Bringer of Bing" (aka Microsoft) issued a security advisory that reports on a new vulnerability in Microsoft DirectX, specifically in Microsoft DirectShow.

While DirectX security flaws are not uncommon, end-users generally receive alerts stemming from other Windows OS and Internet Explorer vulnerabilities; DirectX is usually associated with PC gaming. However, in the case of this incident, Microsoft says that the problem is limited, but remains quite active.

According to the company, the DirectX vulnerability allows remote code execution if the end-user opens a specially crafted QuickTime media file. Current investigations reveal that Windows 2000 Service Pack 4, Windows XP, and Windows Server 2003 are highly susceptible to an attack; Windows Vista and Windows Server 2008 are not vulnerable. Microsoft also said that if successful, the attacker could gain the same user rights as the local user. Consumers whose accounts are configured to have fewer user rights on the system could be less affected than users who operate with administrative user rights.

"In a Web-based attack scenario, an attacker would have to host a Web site that contains a Web page that is used to exploit this vulnerability," the company said, describing a mitigating factor. "An attacker would have no way to force users to visit a malicious Web site. Instead, an attacker would have to convince them to visit the Web site, typically by getting them to click a link that takes them to the attacker's Web site. After they click the link, they would be prompted to perform several actions. An attack could only occur after they performed these actions."

While the company is currently working on a patch, Microsoft has provided an auto workaround here that can be used by way of a simple click. The fix actually disables QuickTime parsing automatically, however consumer who wish to do so manually will need to read the directions, as it involves altering the registry.

Display 17 Comments.
This thread is closed for comments
  • 4 Hide
    apache_lives , May 30, 2009 12:04 AM
    Bing!
  • 3 Hide
    Hitokage , May 30, 2009 12:05 AM
    An exploit via Quicktime... software developed by Apple. I can't even imagine how exploitable their OS is...
  • -3 Hide
    hemelskonijn , May 30, 2009 1:15 AM
    Hitokage an exploit using direct show could be rebuild for several other applications that rely on direct show.
    As Apple's don't use DirectX (sadly otherwise the platform might be worth it) this exploit wont fly on Apple machines.
    In other words this comes down to microsoft software being exploited not quicktime.
  • -3 Hide
    Raidur , May 30, 2009 1:29 AM
    Hmm. Maybe Microsoft is doing some sneaky anti-Apple stuff? o.O
  • 6 Hide
    computabug , May 30, 2009 1:57 AM
    Apple is trying to infect all Windows machines to make people switch to Macs lol
  • 2 Hide
    Jindaman , May 30, 2009 1:57 AM
    Just sounds like Microsoft wants you to buy one of their new OS.
  • 5 Hide
    deepgray , May 30, 2009 2:46 AM
    computabugApple is trying to infect all Windows machines to make people switch to Macs lol

    Or Microsoft trying to infect XP users to make them upgrade to Vista/Win 7!
  • -1 Hide
    ravewulf , May 30, 2009 3:43 AM
    Quicktime sprites are a pain in the ass. Download one with them and at playback they can open whatever infected website they want.
  • -3 Hide
    cruiseoveride , May 30, 2009 7:23 AM
    I thought it was Bling
  • -1 Hide
    rockabye , May 30, 2009 8:49 PM
    JindamanJust sounds like Microsoft wants you to buy one of their new OS.

    I agree, and all while putting the blame on Apple. What a brilliant scheme.
  • 0 Hide
    bardia , May 30, 2009 9:52 PM
    Haha, when Microsoft sucks, it's Microsoft. When Apple sucks, it's Microsoft. I see I see.

    And when XP sucks... well... we just pretend XP doesn't suck.
  • 2 Hide
    njalterio , May 30, 2009 9:56 PM
    If you have Quicktime installed on your computer, you deserve much more then getting virus, you also need to be shot.
  • -2 Hide
    njalterio , May 30, 2009 9:58 PM
    JindamanJust sounds like Microsoft wants you to buy one of their new OS.


    Sure....its not as though Windows 7 is available as a free download or anything, right?...
  • 2 Hide
    rhino13 , May 31, 2009 5:54 PM
    Mac software on the PC has always been horible. There is about as much quality control in their PC software as there is in your toilet. A lot like Adobe now that I think about it...
  • 1 Hide
    alextheblue , June 1, 2009 2:19 AM
    JindamanJust sounds like Microsoft wants you to buy one of their new OS.
    By working on a patch to fix the problem? Darn that evil Microsoft, somehow forcing me to buy a new OS by continuing to support and patch my current OS!
  • 0 Hide
    Jindaman , June 1, 2009 12:05 PM
    Current investigations reveal that Windows 2000 Service Pack 4, Windows XP, and Windows Server 2003 are highly susceptible to an attack; Windows Vista and Windows Server 2008 are not vulnerable.
  • 0 Hide
    gbean02 , June 1, 2009 3:38 PM
    Keep telling me how bad Vista is, and continue using XP. Everyone who has used a computer for 10 years or more, cannot deny that XP Sucked at launch. Hope they patch the exploit before any XP users get infected.