Critical Bof Vulnerability Found In Ffdshow

[Peaches]

Nov 24 2008

Highly critical

Critical BoF vulnerability found in ffdshow affecting all internet browsers

4:01 pm under Bkis Security Advisories

ffdshow is a DirectShow filter and VFW codec for many audio and video formats, such as DivX, Xvid and H.264. It is the most popular audio and video decoder on Windows. Besides a stand-alone setup package, ffdshow is often included in almost all codec pack software such as K-lite Codec Pack, XP Codec Pack, Vista Codec Package, Codec Pack All in one,…

In Oct 2008, SVRT-Bkis has detected a serious buffer overflow vulnerability in ffdshow which affects all available internet browsers. Taking advantage of the flaw, hackers can perform remote attack, inject viruses, steal sensitive information and even take control of the victim’s system.

Since ffdshow is an open source software (can be found at http://sourceforge.net/projects/ffdshow-tryout), we have contacted the developing team and they have patched the vulnerability in the latest version of ffdshow.

http://security.bkis.vn/?p=277 & http://secunia.com/advisories/32846/