DirectShow Security
DirectShow should be used with caution in environments that require high security.
DirectShow does not feature the intimate interaction with system hardware commonly found in other multimedia features, so it does not involve the same types of security concerns as these other features. Instead, DirectShow can introduce vulnerabilities to a platform through interaction with other software outside the control of the platform developer or applications programmer.
DirectShow opens network ports for streaming data. This exposes DirectShow applications, and the platforms that they run on, to the typical security concerns associated with networking, such as denial of service attacks. However, this means as well that you can implement typical known countermeasures, such as firewalls for streaming media, to enhance the security of your platform or application.
**Note **DirectShow opens port 80 when streaming over HTTP and it opens port 1755 when streaming from a Microsoft Media Server (MMS). These port associations hard-coded into DirectShow and therefore cannot be changed. However, a user can override these settings by explicitly specifying a port number in the URL for their streamed content. For example, a user could request http://www.southridgevideo.com/movie.wmv:8080 and so long as the server recognized port 8080, DirectShow could receive the content.
DirectShow is designed around the assumption that your application will be working with trusted networks and trusted data sources. It relies on other layers in your application or system architecture to address common network security tasks, such as and authenticating requests or performing packet checksums. It is also possible for DirectShow applications to be exposed to malicious scripts embedded within certain media file types, such as .asf files.
You should always make sure that any third-party software, like codecs, that you introduce into your DirectShow application is well-tested and comes from a trusted source.
When writing DirectShow applications, always code with the assumption that media data contains formatting or description errors.
See Also
Last updated on Wednesday, April 13, 2005
© 2005 Microsoft Corporation. All rights reserved.