Original release date: July 14, 2009
Last revised: August 27, 2009
Source: US-CERT

Systems Affected

• Microsoft Windows and Windows Server
• Microsoft DirectShow
• Microsoft Virtual PC and Server
• Microsoft Office Publisher
• Microsoft Internet Security and Acceleration (ISA) Server

Overview

Microsoft has released updates that address vulnerabilities in Microsoft Windows, Windows Server, DirectShow, Virtual PC and Server, Office Publisher, and ISA Server.

I. Description

As part of the Microsoft Security Bulletin Summary for July 2009, Microsoft has released updates that address several vulnerabilities in Microsoft Windows, Windows Server, DirectShow, Windows Virtual PC and Server, Office Publisher, and ISA Server. Microsoft indicates that two of these vulnerabilities, CVE-2009-1537 and CVE-2008-0015, are being actively exploited.

II. Impact

A remote, unauthenticated attacker could execute arbitrary code, gain elevated privileges, or cause a vulnerable application to crash.

III. Solution

Microsoft has provided updates for these vulnerabilities in the Microsoft Security Bulletin Summary for July 2009. The security bulletin describes any known issues related to the updates. Administrators are encouraged to note these issues and test for any potentially adverse effects. Administrators should consider using an automated update distribution system such as Windows Server Update Services (WSUS).
 

IV. References

• Microsoft Security Bulletin Summary for July 2009 - <http://www.microsoft.com/technet/security/bulletin/ms09-jul.mspx>
• Microsoft Windows Server Update Services - <http://technet.microsoft.com/en-us/wsus/default.aspx>
• New vulnerability in quartz.dll Quicktime parsing - <http://blogs.technet.com/srd/archive/2009/05/28/new-vulnerability-in-quicktime-parsing.aspx>
• VU#180513 - Microsoft Video ActiveX control stack buffer overflow - <http://www.kb.cert.org/vuls/id/180513>
• TA09-187A - Microsoft Video ActiveX Control Vulnerability - <http://www.us-cert.gov/cas/techalerts/TA09-187A.html>
• CVE-2009-1537 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1537>
• CVE-2008-0015 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0015>

Feedback can be directed to US-CERT.

Produced 2009 by US-CERT, a government organization. Terms of use

July 14, 2009: Initial release
August 27, 2009: Fixed CVE URLs