Attackers cannot directly exploit this vulnerability, and instead rely upon user interaction in order to accomplish an exploit. An attacker must convince a user to view a malicious media file, likely provided as an e-mail attachment or posted on a public website. Attackers may use social engineering techniques in an attempt to convince users to view provided media files.
If an exploit is successful, the attacker could execute arbitrary code with the privileges of the user. End host systems on which users hold elevated privileges are most at risk, as an exploit could result in a complete system compromise. Attackers may leverage the vulnerability to execute code and install malicious software or set up user accounts that could allow later system access.
The Cisco Applied Intelligence team has created an Applied Mitigation Bulletin to address vulnerabilities that Microsoft disclosed in the August 2009 security bulletin release. This Cisco bulletin, which assists administrators in identifying or mitigating these vulnerabilities using Cisco devices, is available at the following link: Cisco Applied Mitigation Bulletin: Microsoft Security Bulletin Release for August 2009
The update available from Microsoft corrects this vulnerability by properly validating AVI data.