Feeds

Buffer the Overflow Slayer v. the ActiveX Files

Flashpix nix 'safe for scripts'

Remote control for virtualized desktops

Microsoft's DirectX Media software development kit may be doing a lot more than helping designers give a realistic flesh tone to Lara Croft's breasts. It could also be introducing critical vulnerabilities into a countless number of applications that are spawned by the SDK.

That's because the SDK, which streamlines much of the work of building graphic-intensive video games and applications, contains a third-party ActiveX control that's vulnerable to a buffer overflow. Labeled DirectTransform FlashPix and provided by the Live Picture Corporation, it leaves applications vulnerable to attacks that allow for the remote execution of code.

An attacker would still have to lure a victim running FlashPix to a visit booby-trapped website or open a maliciously crafted email. But hey, we're talking about virtual worlds and multi-player video games, where people consort with strangers all the time.

"This is worse than your average social engineering situation," says security researcher Rodney Thayer. "If you're in a gaming environment where you're trying to get the dwarf to talk to you in English, you may actually listen to people who give you advice."

Internet Explorer can also be used as an attack vector, because FlashPix is labeled as "safe for scripting".

The vulnerability was discovered by Krystian Kloskowski and is rated "highly critical" in this posting on Secunia. It's also discussed here on the US-Cert website. Proof-of-concept code can be found on MilW0rm here.

The flaw comes courtesy of a boundary error in Live Picture's DXSurface.LivePicture.FLashPix.1, which translates to the DXTLIPI.DLL file on Windows machines. It can be exploited to cause a buffer overflow by assigning excessive strings to the affected property.

Workarounds include setting the kill-bit for the FlashPix control(CLSID {201EA564-A6F6-11D1-811D-00C04FB6BD36}) or disabling all ActiveX controls in the Internet zone.

A Microsoft spokesman said the company's security team is investigating the report and is unaware of any attacks using the claimed vulnerability. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Webcam hacker pervs in MASS HOME INVASION
You thought you were all alone? Nope – change your password, says ICO
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Meet OneRNG: a fully-open entropy generator for a paranoid age
Kiwis to seek random investors for crowd-funded randomiser
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Website security in corporate America
Find out how you rank among other IT managers testing your website's vulnerabilities.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.