Compromise of machines using affected versions of the Xvid software may lead to exposure of confidential information, loss of productivity, and further compromise. In order to perform a sucessful attack, an attacker must cause the victim user to view a malicious movie file. Successful exploitation grants an attacker the privileges of the victim user.

The Xvid Video Codec can be attacked on any Windows media player application that utilizes the DirectShow framework. Windows Media Player is the most straightforward target. The DivX codec is not vulnerable to this issue, which can make a vulnerable system appear safe due to its filter interpositioning. However, a knowledgable attacker can bypass DivX and directly invoke the Xvid codec by using specific media types

The DirectShow component of the Xvid video codec has a logic error in its handling of initialization failure conditions. At a certain point in the setup of the rendering pipeline, the wrong return value is used if there is a memory allocation error. This ultimately allows an attacker to continue with video decoding using data structures that point to invalid and/or free memory.  An attacker can leverage this memory corruption to achieve arbitrary code execution.

Patches were made available on  May 29, 2009.  IBM ISS customers should also enable protection described in this advisory.