Description
Stack-based buffer overflow in the DirectShow Synchronized Accessible Media Interchange (SAMI) parser in quartz.dll for Microsoft DirectX 7.0 through 10.0 allows remote attackers to execute arbitrary code via a crafted SAMI file.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
MS07-064 Microsoft DirectX DirectShow SAMI Buffer Overflow
exploit/windows/misc/ms07_064_sami
Exploit-DB 2
- Microsoft DirectX DirectShow - SAMI Buffer Overflow (MS07-064) (Metasploit) EDB-16442 · remote · Oct 5, 2010 · verified
- Microsoft DirectX SAMI File Parsing - Remote Stack Overflow EDB-4866 · remote · Jan 8, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20071211 Multiple Microsoft DirectShow Remote Code Execution Vulnerabilities third-party-advisory
- VU#804089 third-party-advisory
- MS07-064 vendor-advisory
- 26789 vdb-entry
- oval:org.mitre.oval:def:4520 vdb-entry signature
- ms-directshow-sami-code-execution(38721) vdb-entry
- SSRT071506 vendor-advisory
- 1019073 vdb-entry
- 20071211 Microsoft DirectX 7 and 8 DirectShow Stack Buffer Overflow Vulnerability third-party-advisory
- 28010 third-party-advisory
- 4866 exploit
- TA07-345A third-party-advisory
- ADV-2007-4180 vdb-entry