A remote code execution vulnerability exists in the way that Windows registers and uses the Windows Object Packager that may allow the execution of any executable file named packager.exe, if this executable is located in the same folder than a .PPSX file. The attacker must entice a victim into opening a specially crafted .PPSX file. This file and the associated binary may be delivered to a user through remote WebDAV shares. An attacker may exploit this issue to execute arbitrary code.

This module exploits a stack-based buffer overflow in the MSCOMCTL.OCX control by sending a specially crafted .RTF file. This module runs a web server waiting for vulnerable clients to connect to it. When the client connects, it will try to install an agent by exploiting this vulnerability.

This module exploits a stack-based buffer overflow in the msvidctl.dll ActiveX Control included in Microsoft Windows DirectShow. This module runs a web server waiting for vulnerable clients (Internet Explorer) to connect to it. When the client connects, it will try to install an agent by exploiting this vulnerability.

This module exploits a buffer overflow on Microsoft Windows Movie Maker when parsing a malformed .MSWMM file.

Windows Movie Maker is prone to a vulnerability that may allow the execution of any library file named rsaenh.dll, if this dll is located in the same folder as a .MSWMM file. The attacker must entice a victim into opening a specially crafted .MSWMM file. This file and the associated binary may be delivered to a user through remote WebDAV shares. An attacker may exploit this issue to execute arbitrary code.

Windows Meeting Space is prone to a vulnerability that may allow the execution of any library file named wab32res.dll, if this dll is located in the same folder as a .WCINV file. The attacker must entice a victim into opening a specially crafted .WCINV file. This file and the associated binary may be delivered to a user through remote WebDAV shares. An attacker may exploit this issue to execute arbitrary code.

This module exploits a heap overflow in Windows Media Player (winmm.dll) when handling a specially crafted .MID file. This module runs a web server waiting for vulnerable clients (Internet Explorer 6 or 7) to connect to it. When the client connects, it will try to install an agent by exploiting this vulnerability.

This module exploits a memory corruption in Windows Media Player when parsing a malformed DVR-MS file.

Windows Media Player is prone to a buffer-overflow vulnerability that occurs because it fails to perform adequate boundary checks on user-supplied data via a crafted .ASF file. This module runs a malicious web server on the Core Impact Console and waits for an unsuspecting user to trigger the exploit by connecting to it.

This module exploits a stack-based buffer overflow in the wmex.dll ActiveX Control included in Microsoft Windows Media Encoder 9. This module runs a web server waiting for vulnerable clients (Internet Explorer) to connect to it. When the client connects, it will try to install an agent by exploiting this vulnerability.