Secunia CSI7
Advisories
Research
Forums
Create Profile
Our Commitment
PSI
PSI API
CSI
OSI
xSI
Vulnerabilities
Programs
Open Discussions
My Threads
Create Thread
Statistics
About

Forum Thread: Microsoft Movie Maker 2.x is insecure

You are currently viewing a forum thread in the Secunia Community Forum. Please note that opinions expressed here are not of Secunia but solely reflect those of the user who wrote it.

This thread was submitted in the following forum:
Programs

Relating to this vendor:
Microsoft
And, this specific program:
Microsoft Movie Maker 2.x

This thread has been marked as locked.
Jim.Munn Microsoft Movie Maker 2.x is insecure
Member 12th Mar, 2010 14:50
Ranking: 0
Posts: 2
User Since: 3rd Sep, 2009
System Score: N/A
Location: N/A
On March 12, 2010, Secunia PSI said that Microsoft Movie Maker 2.x is insecure. I have version 2.1.4026.0 (under Windows XP SP3). Since I don't use it, I went to Add/Remove Programs: it does not appear there. I went to Start > Programs, and found it, called "Windows Movie Maker", but with no uninstall option. OK, so let's play safe and upgrade it. Clicking on "Download Solution" in PSI brought me to the Microsoft Update site, but with no mention of Movie Maker. A google search brought me to the Microsoft Download site, where I can download Movie Maker 2.6 for *Vista*, not XP. I can't find any upgrade for XP.

So: Microsoft put a program or app on my computer that I didn't want; it is now insecure; and I can't remove it or upgrade it. Can I just delete or erase the Movie Maker folder without running a risk of messing up the registry?

Jim Munn

M.Hansen RE: Microsoft Movie Maker 2.x is insecure
Secunia Official 12th Mar, 2010 15:22
Score: 188
Posts: 410
User Since: 26th Jan 2009
System Score: N/A
Location: Copenhagen, DK
Hi

Try downloading and installing this update from Microsoft Update:
http://www.microsoft.com/downloads/details.aspx?fa...

You might need to reboot and make a full scan with the PSI.
Bpyatte RE: Microsoft Movie Maker 2.x is insecure
Member 12th Mar, 2010 20:53
Score: 0
Posts: 2
User Since: 31st Dec 2009
System Score: N/A
Location: N/A
Thank you for the information. This cured my problems. I did download you suggested and rebooted the system and ran Secunia scan again and all is GREEN.
Was this reply relevant?
+0
-0
Jim.Munn RE: Microsoft Movie Maker 2.x is insecure
Member 13th Mar, 2010 15:09
Score: 0
Posts: 2
User Since: 3rd Sep 2009
System Score: N/A
Location: N/A
Thank you for:
Try downloading and installing this update from Microsoft Update:
http://www.microsoft.com/downloads/details.aspx?fa...

Unfortunately when I tried to run that patch, it did not install properly. I got the message that it could not run because my OS is in a different language (French, actually).

Movie Maker is not listed at the Microsoft France site. Even when I click on "Contact us" there, they want to know which product I am writing about, and I cannot go further because their own product is not in their list.

I bought this second-hand machine with XP in French on it, here in France, and it has "Windows Movie Maker" on it, but it does not appear in the "Add/Remove" list, and there is no uninstaller associated with it in "Start > Programs > Windows Movie Maker." So my machine is still insecure.

Was this reply relevant?
+0
-0
Maurice Joyce RE: Microsoft Movie Maker 2.x is insecure
Handling Contributor 13th Mar, 2010 17:00
Score: 11620
Posts: 8,911
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Jim,
Try & remove it using this tool:

Windows Installer Cleanup Utility
=======================
Although U will see items listed this tool should NOT be used to remove any part of Microsoft Office 2007.

If a programme is installed using Windows Installer it can be removed by using the Microsoft Cleanup Utility.

Download it from here:

http://support.microsoft.com/kb/290301

Once downloaded, open the programme & scroll up & down looking for the programme U wish to uninstall.

If found,highlight it & click the remove button (bottom right)

Reboot.


--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+11
-0
ddmarshall RE: Microsoft Movie Maker 2.x is insecure
Dedicated Contributor 13th Mar, 2010 19:29
Score: 1205
Posts: 957
User Since: 8th Nov 2008
System Score: 98%
Location: UK
Last edited on 13th Mar, 2010 20:02
The French version of the download is here:

http://www.microsoft.com/downloads/details.aspx?di...

Movie Maker is a component of XP and Vista. I don't think you can uninstall the packaged versions. More details here:

http://www.microsoft.com/technet/security/bulletin...

If you expand the section
Movie Maker and Producer Buffer Overflow Vulnerability - CVE-2010-0265
and

Workarounds for Movie Maker Buffer Overflow Vulnerability - CVE-2010-0265

you will find a method of editing the Registry to prevent the vulnerability being exploited. You could try this if you can't get the update to install.

--
This answer is provided “as-is.” You bear the risk of using it.
Was this reply relevant?
+0
-0
Maurice Joyce RE: Microsoft Movie Maker 2.x is insecure
Handling Contributor 13th Mar, 2010 21:56
Score: 11620
Posts: 8,911
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Jim,
I would try & update on the advice given by @ddmarshall.

After much effort I did remove Movie Maker from my XP test machine. It all went a bit pear shaped but I think it is now stable again. I now know why the link in the PSI toolbox sending U to add/remove does not work!!

"Testing the depth of the water using both feet is not always a good idea".

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+1
-0

This thread has been marked as locked.


 Products Solutions Customers Partner Resources Company
 
 Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)
 Industry
Compliance
Technology
Integration
 Customers
Testimonials
 VARS
MSSP
Technology Partners
References
 Reports
Webinars
Events
 About us
Careers
Memberships
Newsroom


 
© 2002-2014 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability