MS12-014: Indeo, a blast from the past

Today, we shipped security update MS12-014 to address an issue in the Indeo codec. With this blog post, we hope to preemptively answer some common questions that are likely to surface as researchers analyze this security update.

Indeo: Blast from the Past

Indeo is a video codec that was first developed in 1992, long before some of you reading this blog post were born. :) In the days before MPEG – and more than a decade before youtube – Indeo was one of the first video codecs allowing full-speed video playback without using hardware acceleration.

However, today Indeo is an obsolete technology. In fact, Windows Vista and all later versions of Windows shipped with the codec disabled by default. In 2009, we took a further step of attack surface reduction for older versions of Windows by releasinga security advisory and shipping an update to block Indeo from being launched in Internet Explorer or Windows Media Player. That update, shipped via Automatic Updates, removed the most common remote attack vectors for this code while still allowing games or other legacy applications to leverage the codec locally and continue to function.

MS12-014: Why and How

Windows now blocks the remote video playback functionality of Indeo but the codec itself and its infrastructure remain on the system for legacy application support. Unfortunately, a DLL Preloading issue has been identified leveraging Indeo. In the following set of circumstance, an attacker could run arbitrary code on a system:

• If an attacker lures a victim into browsing to a network share or WebDAV share where attacker has write access, AND
• If the attacker lures victim into double-clicking a content filetype that is handled by or registered to Indeo, AND
• If the attacker has placed a specifically-named malicious DLL on the share,
• Then Indeo will inadvertently load the malicious DLL while attempting to open the content file on which the victim double-clicked.

Due to the particular challenges in servicing Indeo, we took an unusual approach this time. This security update drops a “dummy DLL” on the system having the filename that the attacker’s malicious DLL would need to have to exploit the vulnerability. This effectively removes the vulnerability because the DLL will be found already on the system and Indeo will not attempt to load a malicious DLL from the attacker-controlled share.

Hope that helps answer questions you might have about this security update.

Thanks to Josh Carlson, MSRC Ops for the help with this one. (and congrats on shipping your first bulletin)

- Jonathan Ness, MSRC Engineering