Compromise of machines using affected versions of the Xvid
software may lead to exposure of confidential information, loss of productivity,
and further compromise. In order to perform a sucessful attack, an attacker must cause the victim user to view a malicious movie file. Successful exploitation grants an attacker the privileges of the victim user.

Vulnerable users can be attacked through this vulnerability on both Windows and Unix systems, through any media application that uses the Xvid codec. IBM ISS has verified vulnerability on Windows Media Player under Windows, but it is likely that the issue is exploitable under Unix systems as well. The DivX codec is not vulnerable to this issue, which can make a vulnerable system appear safe due to its filter interpositioning. However, a knowledgable attacker can often bypass DivX and directly invoke the Xvid codec by using specific media types.

In certain situations, a video stream can directly provide a macroblock number, which is an index into a large datastructure used in the decoding of video. This macroblock number is stored in the file using a variable bit-length field that attempts to use as few bits as necessary to represent the number. This design appears safe as it considerably limits the maximum macroblock that a file can index, but it is insufficient protection. An attacker can carefully choose other aspects of the file and specify a macroblock number that will modify memory outside of the bounds of the intended data structure.  Ultimately, this leads to attacker-controlled corruption of data on the heap, which leads to arbitrary code execution.

Patches were made available on  May 29, 2009.  IBM ISS customers should also enable protection described in this advisory.