CVE-2008-0015 Activex-directshow-video-buffer-overflow on current Windows OS since yesterday

andreas_welcker · February 2, 2022, 2:11pm

hi, has anybody else findings of this old vuln with agent scan in the environment since yesterday? maybe false positives? all os above Windows Server 2012R2 / Win 10 21H2

https://docs.microsoft.com/en-us/security-updates/SecurityAdvisories/2009/972890

2022-02-02 15_09_03-InsightVM Security Console __ Vulnerability Information

pete_jacob · February 2, 2022, 3:34pm

hello @andreas_welcker yes! I see pretty much all my assets are flagged for this now.

andreas_welcker · February 2, 2022, 3:37pm

thanks for sharing

rrobinson · February 2, 2022, 9:04pm

Yes, we are seeing them to. I had to add exceptions but would like to know why they showed up yesterday.

christiansm_christiansm · February 3, 2022, 2:41am

+1

trohrer · February 3, 2022, 3:22pm

Yup, I’m seeing it too. Rapid7 “modified” this vulnerability check on 2/2, apparently.

kevin_mccabe · February 3, 2022, 5:19pm

This issue should now be fixed once you apply the content release for 2022-02-02.

What happened was an update on 2022-02-01 included a small fix to help one customer experiencing a false positive for this CVE.

Unfortunately, it inadvertently highlighted a separate bug in the agent resulting in the false positives you have seen.

The content update shipped 2022-02-02 has rectified this and added more robust logic to the check.