Programming Microsoft DirectShow For Digital Vi...

The image analysis software market has seen many products for advanced users, as well as products limited to specific functions for a specific application. Neither product type effectively addressed the needs of non-experts in imaging science and programming. For these persons, and for those who need to create effective, controlled, laboratory processes to extract data from digital images, now there is a software product to meet all of these needs : Aphelion Lab.

Programming Microsoft DirectShow for Digital Vi...

- When Internet Explorer processes a specially crafted data stream header, Internet Explorer may corrupt system memory in such a way that an attacker could execute arbitrary code. (CVE-2009-1547)- Internet Explorer validates arguments incorrectly under specific circumstances. As a result, a specially crafted Web page could be displayed in such a way that an attacker could execute arbitrary code in the context of the logged on user. (CVE-2009-2529)- A remote code execution vulnerability exists when Internet Explorer attempts to access an object that has not been initialized or has been deleted. (CVE-2009-2530, CVE-2009-2531) Microsoft has released a security update that addresses these vulnerabilities by modifying the way that Internet Explorer processes data stream headers, validates arguments, and handles objects in memory.The security update is rated Critical for all supported releases of Internet Explorer: Internet Explorer 5.01, Internet Explorer 6, Internet Explorer 6 Service Pack 1, Internet Explorer 7, and Internet Explorer 8.Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):October 2009 Security Database Updates are Available (KB974455)ConsequenceSuccessful exploitation allows arbitrary execution of code.SolutionPatch:Following are links for downloading patches to fix the vulnerabilities:Microsoft Windows 2000 Service Pack 4 (Microsoft Internet Explorer 5.01 Service Pack 4)Microsoft Windows 2000 Service Pack 4 (Microsoft Internet Explorer 6 Service Pack 1)Windows XP Service Pack 2 and Windows XP Service Pack 3 (Microsoft Internet Explorer 6)Windows XP Professional x64 Edition Service Pack 2 (Microsoft Internet Explorer 6)Windows Server 2003 Service Pack 2 (Microsoft Internet Explorer 6)Windows Server 2003 x64 Edition Service Pack 2 (Microsoft Internet Explorer 6)Windows Server 2003 with SP2 for Itanium-based Systems (Microsoft Internet Explorer 6)Windows XP Service Pack 2 and Windows XP Service Pack 3 (Windows Internet Explorer 7)Windows XP Professional x64 Edition Service Pack 2 (Windows Internet Explorer 7)Windows Server 2003 Service Pack 2 (Windows Internet Explorer 7)Windows Server 2003 x64 Edition Service Pack 2 (Windows Internet Explorer 7)Windows Server 2003 with SP2 for Itanium-based Systems (Windows Internet Explorer 7)Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2 (Windows Internet Explorer 7)Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2 (Windows Internet Explorer 7)For a complete list of patch download links, including Windows 7, please refer to Microsoft Security Bulletin MS09-054.Workarounds:CVE-2009-2529, CVE-2009-2530:- Set Internet and Local intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting- Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zoneImpact of the Workaround:On visiting Web sites on the Internet or Intranet that use ActiveX or Active Scripting to provide additional functionality, you will be prompted frequently when you enable this workaround.Microsoft Server Message Block (SMBv2) Remote Code Execution Vulnerability (MS09-050) and Shadow Brokers (EDUCATEDSCHOLAR)SeverityUrgent5Qualys ID90527Vendor ReferenceMS09-050CVE ReferenceCVE-2009-2526, CVE-2009-2532, CVE-2009-3103CVSS ScoresBase 10 / Temporal 8.7DescriptionThe Microsoft Server Message Block (SMBv2) Protocol is a network file sharing protocol used to provide shared access to files, printers, serial ports, and miscellaneous communications between nodes on a network. It is a client-server implementation and consists of a set of data packets, each containing a request sent by the client or a response sent by the server.A remote code execution and denial of service vulnerability has been identified in the Microsoft SMB implementation because it does not appropriately parse SMB negotiation requests. An attacker can exploit this issue by sending specially crafted SMB packets.Affected Software:Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2QID Detection Logic (Unauthenticated):The sends a specially crafted non-invasive TCP request to check if the SMBv2 remote code execution vulnerability exists on the target based on the response received. ConsequenceSuccessful exploitation of this vulnerability could allow an attacker to take complete control of an affected system. Most attempts to exploit this vulnerability will cause an affected system to stop responding and restart.SolutionPatch:Following are links for downloading patches to fix the vulnerabilities:Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2Refer to Microsoft Security Bulletin MS09-050 for further details.Workaround:Microsoft has provided a capability of enabling and disabling the workarounds automatically. Refer to Microsoft Knowledge Base Article 975497 for further details.The workarounds can also be applied manually. Details are listed below:1) Disable SMB v2. To modify the registry key, perform the following steps:- Click Start, click Run, type Regedit in the Open box, and then click OK.- Locate and then click the following registry subkey: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services- Click LanmanServer.- Click Parameters.- Right-click to add a new DWORD (32 bit) Value.- Enter smb2 in the Name data field, and change the Value data field to 0.- Exit.- Restart the "Server" service. This can be done in the following two ways:1. Open up the computer management MMC, navigate to Services and Applications, click Services, right-click the Server service name and click Restart. Answer Yes in the pop-up menu.2. From a command prompt with administrator privileges, type net stop server and then net start server.Impact of the workaround: The host will not be able to communicate using SMB2. Instead, the host will communicate using SMB 1.0. This should not impact basic services such as file and printer sharing. These will continue to function as normal.Two TCP ports, 139 and 445, should be blocked at the firewall to protect systems behind the firewall from attempts to exploit this vulnerability. Impact of the workaround: Blocking the ports can cause several windows services or applications using those ports to stop functioning.Also, refer to Security Bulletin MS09-050 and Microsoft Security Advisory (975497) to obtain additional details on applying the workarounds.Microsoft Windows Media Runtime Remote Code Execution Vulnerability (MS09-051)SeverityUrgent5Qualys ID90546Vendor ReferenceMS09-051CVE ReferenceCVE-2009-0555, CVE-2009-2525CVSS ScoresBase 9.3 / Temporal 7.7DescriptionThe Microsoft Windows Media Format Runtime provides information and tools for applications that use Windows Media content.- A remote code execution vulnerability exists in Windows Media Player due to the improper processing of specially crafted Advanced Systems Format (ASF) files. (CVE-2009-0555)- A remote code execution vulnerability exists in the Microsoft Windows Media Runtime because it does not properly initialize certain functions in compressed audio files. (CVE-2009-2525)Microsoft has released a security update that addresses these vulnerabilities by changing the manner in which the Windows Media Runtime processes ASF files and initializes functions in compressed audio files.This security update is rated Critical for DirectShow WMA Voice Codec, Windows Media Audio Voice Decoder, and Audio Compression Manager on supported editions of Microsoft Windows 2000; Windows XP; Windows Server 2003, except for Itanium-based editions; Windows Vista; and Windows Server 2008, except for Itanium-based editions.Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):October 2009 Security Database Updates are Available (KB975682)ConsequenceAn attacker who successfully exploited these vulnerabilities could gain the same user rights as the local user.SolutionPatch:Following are links for downloading patches to fix the vulnerabilities:Microsoft Windows 2000 Service Pack 4 (DirectShow WMA Voice Codec)Microsoft Windows 2000 Service Pack 4 (Windows Media Audio Voice Decoder)Microsoft Windows 2000 Service Pack 4 (Audio Compression Manager)Windows XP Service Pack 2 (DirectShow WMA Voice Codec)Windows XP Service Pack 2 (Windows Media Audio Voice Decoder)Windows XP Service Pack 2 (Audio Compression Manager)Windows XP Service Pack 3 (DirectShow WMA Voice Codec)Windows XP Service Pack 3 (Windows Media Audio Voice Decoder)Windows XP Service Pack 3 (Audio Compression Manager)Windows XP Professional x64 Edition Service Pack 2 (DirectShow WMA Voice Codec)Windows XP Professional x64 Edition Service Pack 2 (Windows Media Audio Voice Decoder)Windows XP Professional x64 Edition Service Pack 2 (Windows Media Audio Voice Decoder in Windows Media Format SDK 9.5 x64 Edition)Windows XP Professional x64 Edition Service Pack 2 (Windows Media Audio Voice Decoder in Windows Media Format SDK 11)Windows XP Professional x64 Edition Service Pack 2 (Audio Compression Manager)Windows Server 2003 Service Pack 2 (DirectShow WMA Voice Codec)Windows Server 2003 Service Pack 2 (Windows Media Audio Voice Decoder)For a complete list of patch download links, please refer to Microsoft Security Bulletin MS09-051.Workarounds:- CVE-2009-0555: Unregister wmspdmod.dll- CVE-2009-2525: Deny access to msaud32.acmRefer to Microsoft Security Bulletin MS09-051 to obtain additional details on the workarounds.Microsoft Windows Media Player Remote Code Execution Vulnerability (MS09-052)SeverityCritical4Qualys ID90544Vendor ReferenceMS09-052CVE ReferenceCVE-2009-2527CVSS ScoresBase 9.3 / Temporal 7.3DescriptionMicrosoft Windows Media Player is a multimedia application available for the Windows operating system.The application is prone to remote code execution vulnerability if a specially crafted ASF file is played using Windows Media Player 6.4. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. (CVE-2009-2527)Microsoft Windows Media Player 6.4 when installed on all supported editions of Microsoft Windows 2000, Windows XP, and Windows Server 2003 are affected by this issue.Microsoft has released a security update that addresses the vulnerability by correcting the manner in which Windows Media Player 6.4 handles specially crafted ASF files.Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):October 2009 Security Database Updates are Available (KB974112)ConsequenceSuccessful exploitation of this vulnerability may allow and attacker to take complete control of an affected system.SolutionPatch:Following are links for downloading patches to fix the vulnerabilities:Microsoft Windows 2000 Service Pack 4 (Microsoft Windows Media Player 6.4)Windows XP Service Pack 2 and Windows XP Service Pack 3 (Microsoft Windows Media Player 6.4)Windows XP Professional x64 Edition Service Pack 2 (Microsoft Windows Media Player 6.4)Windows Server 2003 Service Pack 2 (Microsoft Windows Media Player 6.4)Windows Server 2003 x64 Edition Service Pack 2 (Microsoft Windows Media Player 6.4)Refer to Microsoft Security Bulletin MS09-052 for further details.Workarounds:1) Modify the Access Control List (ACL) on strmdll.dllImpact of workaround #1: Windows Media Player 6.4 will not be able to play media files.2) For Windows 2000, upgrade to the latest version of Windows Media Player 93) For non-multimedia folder types, the Windows shell attack vector can be mitigated by using Windows Classic Folders.Additional details on the workarounds can be obtained at Microsoft Security Bulletin MS09-052.Microsoft FTP Service for Internet Information Services Remote Code Execution Vulnerability (MS09-053 and KB97519)SeverityUrgent5Qualys ID27302Vendor ReferenceKB975191, MS09-053CVE ReferenceCVE-2009-2521, CVE-2009-3023CVSS ScoresBase 9 / Temporal 7DescriptionInternet Information Services (IIS) is a set of Internet-based services for servers created by Microsoft for use with Microsoft Windows.The application is prone to the following vulnerabilities:- A denial of service vulnerability exists in the FTP Service in Microsoft Internet Information Services 5.0, Microsoft Internet Information Services 5.1, and Microsoft Internet Information Services 6.0. The vulnerability could allow remote code execution on systems running FTP Service on IIS 5.0, or denial of service on systems running FTP Service on IIS 5.1, IIS 6.0. (CVE-2009-3023)- A denial of service is caused by the way that the Microsoft FTP service in IIS handles list commands. (CVE-2009-2521)Note: There is malicious code circulating that actively exploits this issue.Affected Software and Components:Microsoft Windows 2000 Service Pack 4 (Microsoft Internet Information Services 5.0)Windows XP Service Pack 2 and Windows XP Service Pack 3 (Microsoft Internet Information Services 5.1)Windows XP Service x64 Edition Service Pack 2 (Microsoft Internet Information Services 6.0)Windows Server 2003 Service Pack 2 (Microsoft Internet Information Services 6.0) Windows Server 2003 x64 Edition Service Pack 2 (Microsoft Internet Information Services 6.0)Windows Server 2003 with SP2 for Itanium-based Systems (Microsoft Internet Information Services 6.0)Windows Vista, Windows Vista SP1, and Windows Vista SP2 (Microsoft Internet Information Services 7.0 FTP Service 6.0)Windows Vista x64 Edition, Windows Vista x64 Edition SP1, and Windows Vista x64 Edition SP2 (Microsoft Internet Information Services 7.0 FTP Service 6.0)Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems SP2 (Microsoft Internet Information Services 7.0 FTP Service 6.0)Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems SP2 (Microsoft Internet Information Services 7.0 FTP Service 6.0)Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems SP2 (Microsoft Internet Information Services 7.0 FTP Service 6.0)Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):October 2009 Security Database Updates are Available (KB975254)ConsequenceIf this vulnerability is successfully exploited, it will allow an unauthenticated attacker to execute arbitrary code with system-level privileges.Attacks against Microsoft Internet Information Server 6.0 targets may result in a denial of service.SolutionPatch:Following are links for downloading patches to fix the vulnerabilities:Microsoft Windows 2000 Service Pack 4Windows XP Service Pack 2 and Windows XP Service Pack 3Windows XP Professional x64 Edition Service Pack 2Windows Server 2003 Service Pack 2Windows Server 2003 x64 Edition Service Pack 2Windows Server 2003 with SP2 for Itanium-based SystemsWindows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2Refer to Microsoft Security Bulletin MS09-053 for further details.Workaround:1) Modify NTFS file system permissions to disallow directory creation by FTP users. Perform the following steps with administrative privileges to remove directory creation privileges from the Users group. - Browse to the root directory of your FTP site. By default this is in %systemroot%\inetpub\ftproot.- Right-click on the directory and select Properties.- Click the Security tab and click Advanced.- Click Change Permissions.- Select the Users group and click Edit. If you have a configured FTP user or custom group to manage your FTP users, replace the Users group with the custom identities.- Deselect Create Folders/Append Data.Impact of workaround #1: FTP users will not be able to create directories through the FTP service. FTP users will still be able to upload files to existing directories through the FTP service.2) Do not allow FTP write access to untrusted anonymous users. To modify IIS permissions to prevent FTP write access, perform the following steps:- Launch IIS Manager.- Right click Default FTP Site and point to Properties.- Click the Home Directory tab.- Ensure that Write is deselected.Impact of workaround #2: Users will not be able to transfer files using FTP, but can do so using WebDAV.3) Disable the FTP service.Impact of workaround #3: Users will no longer be able to use the FTP service.Refer to the advisory to obtain detailed instructions on the workarounds.Microsoft Cumulative Security Update for ActiveX Kill Bits (MS09-055)SeverityCritical4Qualys ID90549Vendor ReferenceMS09-055CVE ReferenceCVE-2009-2493CVSS ScoresBase 9.3 / Temporal 6.9DescriptionA remote code execution vulnerability exists in a few of the Microsoft ActiveX controls, which were compiled using the vulnerable Microsoft Active Template Library described in Microsoft Security Bulletin MS09-035. The vulnerability is due to issues in the ATL headers that handle instantiation of an object from data streams. For components and controls built using ATL, unsafe usage of OleLoadFromStream could allow the instantiation of arbitrary objects in Internet Explorer that can bypass certain related security policies. When the Microsoft ActiveX Control is instantiated in Internet Explorer, the control may corrupt the system state in such a way that an attacker could run arbitrary code. (CVE-2009-2493)Microsoft has released a security update to address this vulnerability by setting a kill bit so that the vulnerable controls do not run in Internet Explorer.Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):October 2009 Security Database Updates are Available (KB973525)ConsequenceSucce