CVE-2012-0004

Vulnerability

The vulnerability resides in Microsoft DirectShow, specifically in the Line21 filter responsible for closed captioning, within Quartz.dll and Qdvd.dll. It allows remote code execution when a user opens a specially crafted media file. Affected versions include Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 [1].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious media file and convincing a user to open it, typically via email or a web link. No authentication is required, and the user interaction is limited to opening the file. The vulnerability is triggered during the parsing of the media file by DirectShow [1][2].

Impact

Successful exploitation grants the attacker the same user rights as the local user. If the user has administrative privileges, the attacker can gain complete control of the system, including the ability to install programs, view, change, or delete data, and create new accounts [1][2].

Mitigation

Microsoft released security update MS12-004 in January 2012, which addresses this vulnerability by correcting how DirectShow parses media files. The update is rated Critical for most affected systems. Customers with automatic updating enabled are protected. No workaround is documented [1][2].