Secunia

eEye Digital Security has been reported a vulnerability in Microsoft Windows DirectShow, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a validation error in QUARTZ.DLL when decoding AVI movie files. This can be exploited to write a null byte to an arbitrary memory location e.g. the header of the heap block.

Successful exploitation allows arbitrary code execution, but requires that the user open a malicious AVI file with specially crafted value in the length field of the "strn" element.

Solution
Apply patches.
Further details available in Customer Area

Provided and/or discovered by
Fang Xing, eEye Digital Security.

Changelog
Further details available in Customer Area

Original Advisory
MS05-050 (KB904706):
http://www.microsoft.com/technet/security/Bulletin/MS05-050.mspx

eEye Digital Security:
http://www.eeye.com/html/research/advisories/AD20051011a.html

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area