DirectX CVE-2009-1537: 2009 QuickTime Parser Bug in KEV
Only Windows 2000, XP and Server 2003 have the vulnerable QuickTime parser, it was patched in July 2009, and those systems have been unsupported for over a decade; find and isolate any that remain rather than worrying about this CVE.
Must act: Anyone still running Windows XP, Windows Server 2003 or Windows 2000, typically in industrial, medical, lab or kiosk systems, especially if users open media files or browse the web on them.
Can relax: Everyone on Windows Vista, Server 2008 or any later release; Microsoft lists them as not affected, and the vulnerable component is not present.
- Inventory any Windows 2000, XP or Server 2003 machines, including embedded and vendor-managed systems.
- Replace them, or isolate them on a segment with no internet access and no email or web use.
- On any that must remain, confirm MS09-028 (KB971633) is installed.