alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-10002
Matching passage: CVE-2015-10002. CWE: CWE-404. CVSS: 5.5. A vulnerability classified as problematic has been found in Kiddoware Kids Place. This affects the Home Button Protection. A repeated pressing of the button causes a local denial of service. It is recommended to upgrade the affected component.
Near-miss passage: CVE-2015-10085. CWE: CWE-404. CVSS: 7.5. A vulnerability was found in GoPistolet. It has been declared as problematic. This vulnerability affects unknown code of the component MTA. The manipulation leads to denial of service. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as b91aa4674d460993765884e8463c70e6d886bc90. It is recommended to apply a patch to fix this issue. VDB-221506 is the identifier assigned to this vulnerability.
Query: patch priority for CVE-2015-3405
Matching passage: CVE-2015-3405. CWE: CWE-331. CVSS: 7.5. ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.
Near-miss passage: CVE-2015-3006. CWE: CWE-331. CVSS: 6.5. On the QFX3500 and QFX3600 platforms, the number of bytes collected from the RANDOM_INTERRUPT entropy source when the device boots up is insufficient, possibly leading to weak or duplicate SSH keys or self-signed SSL/TLS certificates. Entropy increases after the system has been up and running for some time, but immediately after boot, the entropy is very low. This issue only affects the QFX3500 and QFX3600 switches. No other Juniper Networks products or platforms are affected by this weak entropy vulnerability.
Query: CVE similar to CVE-2015-0250
Matching passage: CVE-2015-0250. CWE: UNKNOWN. CVSS: 6.400000095367432. XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.
Near-miss passage: CVE-2015-0417. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Portal Framework, a different vulnerability than CVE-2015-0388.
Query: describe CVE-2015-5073
Matching passage: CVE-2015-5073. CWE: CWE-119. CVSS: 9.100000381469727. Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash) or obtain sensitive information from heap memory and possibly bypass the ASLR protection mechanism via a crafted regular expression with an excess closing parenthesis.
Near-miss passage: CVE-2015-8073. CWE: CWE-119. CVSS: 10.0. mediaserver in Android 4.4 and 5.1 before 5.1.1 LMY48X allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 14388161, a different vulnerability than CVE-2015-6608 and CVE-2015-8072.
Query: alert when Detects default RemCom pipe creation
Matching passage: Sigma rule: Detects default RemCom pipe creation. Logsource: windows / pipe_created. Rule: title: PUA - RemCom Default Named Pipe id: d36f87ea-c403-44d2-aa79-1a0ac7c24456 related: - id: 9e77ed63-2ecf-4c7b-b09d-640834882028 type: obsolete status: test description: Detects default RemCom pipe creation references: - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view - https://github.com/kavika13/RemCom author: Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2023-08-07 modified: 2023-11-30 tags: - attack.lateral-movement - attack.t1021.002 - attack.execution - attack.t1569.002 logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName|contains: \RemCom condition: selection falsepositives: - Legitimate Administrator activity level: medium
Near-miss passage: Sigma rule: Detects usage of the Quarks PwDump tool via commandline arguments. Logsource: windows / process_creation. Rule: title: HackTool - Quarks PwDump Execution id: 0685b176-c816-4837-8e7b-1216f346636b status: test description: Detects usage of the Quarks PwDump tool via commandline arguments references: - https://github.com/quarkslab/quarkspwdump - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/seedworm-apt-iran-middle-east author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-05 modified: 2023-02-05 tags: - attack.credential-access - attack.t1003.002 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \QuarksPwDump.exe selection_cli: CommandLine: - ' -dhl' - ' --dump-hash-local' - ' -dhdc' - ' --dump-hash-domain-cached' - ' --dump-bitlocker' - ' -dhd ' - ' --dump-hash-domain ' - --ntds-file condition: 1 of selection_* falsepositives: - Unlikely level: high
Query: secure coding against Use of Cache Containing Sensitive Information
Matching passage: CWE-524 Use of Cache Containing Sensitive Information. The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.
Near-miss passage: CWE-704 Incorrect Type Conversion or Cast. The product does not correctly convert an object, resource, or structure from one type to a different type.
Query: CVE similar to CVE-2015-1880
Matching passage: CVE-2015-1880. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-8398. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5.8.17 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to rest/prototype/1/session/check.
Query: describe CVE-2015-2881
Matching passage: CVE-2015-2881. CWE: CWE-798. CVSS: 9.800000190734863. Gynoii has a password of guest for the backdoor guest account and a password of 12345 for the backdoor admin account.
Near-miss passage: CVE-2015-2882. CWE: CWE-798. CVSS: 9.800000190734863. Philips In.Sight B120/37 has a password of b120root for the backdoor root account, a password of /ADMIN/ for the backdoor admin account, a password of merlin for the backdoor mg3500 account, a password of M100-4674448 for the backdoor user account, and a password of M100-4674448 for the backdoor admin account.
Query: detection rule: Detects the creation of the LiveKD driver, which is used for live kernel debugging
Matching passage: Sigma rule: Detects the creation of the LiveKD driver, which is used for live kernel debugging. Logsource: windows / file_event. Rule: title: LiveKD Driver Creation id: 16fe46bb-4f64-46aa-817d-ff7bec4a2352 status: test description: Detects the creation of the LiveKD driver, which is used for live kernel debugging references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-16 tags: - attack.privilege-escalation - attack.stealth logsource: product: windows category: file_event detection: selection: TargetFilename: C:\Windows\System32\drivers\LiveKdD.SYS Image|endswith: - \livekd.exe - \livek64.exe condition: selection falsepositives: - Legitimate usage of LiveKD for debugging purposes will also trigger this level: medium
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via VAR++ LAUNCHER. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell id: e54f5149-6ba3-49cf-b153-070d24679126 status: test description: Detects Obfuscated Powershell via VAR++ LAUNCHER references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-13 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|re: (?i)&&set.*(\{\d\}){2,}\\"\s+?-f.*&&.*cmd.*/c condition: selection_4104 falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-8057
Matching passage: CVE-2015-8057. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Near-miss passage: CVE-2015-4860. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI, a different vulnerability than CVE-2015-4883.
Query: Sigma rule for Detects triggering of AMSI by Windows Defender.
Matching passage: Sigma rule: Detects triggering of AMSI by Windows Defender.. Logsource: windows / windefend. Rule: title: Windows Defender AMSI Trigger Detected id: ea9bf0fa-edec-4fb8-8b78-b119f2528186 status: stable description: Detects triggering of AMSI by Windows Defender. references: - https://learn.microsoft.com/en-us/windows/win32/amsi/how-amsi-helps author: Bhabesh Raj date: 2020-09-14 modified: 2022-12-07 tags: - attack.execution - attack.t1059 logsource: product: windows service: windefend detection: selection: EventID: 1116 SourceName: AMSI condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects newly added root certificate authority to an AzureAD tenant to support certificate based authentication.. Logsource: azure / auditlogs. Rule: title: New Root Certificate Authority Added id: 4bb80281-3756-4ec8-a88e-523c5a6fda9e status: test description: Detects newly added root certificate authority to an AzureAD tenant to support certificate based authentication. references: - https://posts.specterops.io/passwordless-persistence-and-privilege-escalation-in-azure-98a01310be3f - https://goodworkaround.com/2022/02/15/digging-into-azure-ad-certificate-based-authentication/ author: Harjot Shah Singh, '@cyb3rjy0t' date: 2024-03-26 tags: - attack.credential-access - attack.persistence - attack.privilege-escalation - attack.defense-impairment - attack.t1556 logsource: product: azure service: auditlogs detection: selection: OperationName: Set Company Information TargetResources.modifiedProperties.newValue|contains: TrustedCAsForPasswordlessAuth condition: selection falsepositives: - Unknown level: medium
Query: alert when Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration
Matching passage: Sigma rule: Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration. Logsource: windows / dns_query. Rule: title: DNS Query To Ufile.io id: 1cbbeaaf-3c8c-4e4c-9d72-49485b6a176b related: - id: 090ffaad-c01a-4879-850c-6d57da98452d type: similar status: test description: Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration references: - https://thedfirreport.com/2021/12/13/diavol-ransomware/ author: yatinwad, TheDFIRReport date: 2022-06-23 modified: 2023-09-18 tags: - attack.exfiltration - attack.t1567.002 logsource: product: windows category: dns_query detection: selection: QueryName|contains: ufile.io condition: selection falsepositives: - DNS queries for "ufile" are not malicious by nature necessarily. Investigate the source to determine the necessary actions to take level: low
Near-miss passage: Sigma rule: Compress target file into a cab file stored in the Alternate Data Stream (ADS) of the target file.. Logsource: windows / process_creation. Rule: title: Suspicious Diantz Alternate Data Stream Execution id: 6b369ced-4b1d-48f1-b427-fdc0de0790bd status: test description: Compress target file into a cab file stored in the Alternate Data Stream (ADS) of the target file. references: - https://lolbas-project.github.io/lolbas/Binaries/Diantz/ author: frack113 date: 2021-11-26 modified: 2022-12-31 tags: - attack.stealth - attack.t1564.004 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - diantz.exe - .cab CommandLine|re: :[^\\] condition: selection falsepositives: - Very Possible level: medium
Query: detection rule: Detects write access requests to the Windows Defender exclusions registry keys. This could be an indication of an attack
Matching passage: Sigma rule: Detects write access requests to the Windows Defender exclusions registry keys. This could be an indication of an attack. Logsource: windows / security. Rule: title: Windows Defender Exclusion Registry Key - Write Access Requested id: e9c8808f-4cfb-4ba9-97d4-e5f3beaa244d related: - id: 46a68649-f218-4f86-aea1-16a759d81820 type: derived - id: a33f8808-2812-4373-ae95-8cfb82134978 type: derived status: test description: 'Detects write access requests to the Windows Defender exclusions registry keys. This could be an indication of an attacker trying to request a handle or access the object to write new exclusions in order to bypass security. ' references: - https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/ author: '@BarryShooshooga, Nasreddine Bencherchali (Nextron Systems)' date: 2019-10-26 modified: 2023-11-11 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: security definition: 'Requirements: Audit Policy : Security Settings/Local Policies/Audit Policy, Registry System Access Control (SACL): Auditing/User' detection: selection: AccessList|contains: - '%%4417' - '%%4418' EventID: - 4656 - 4663 ObjectName|contains: \Microsoft\Windows Defender\Exclusions\ condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the export of the target Registry key to a file.. Logsource: windows / process_creation. Rule: title: Exports Registry Key To a File id: f0e53e89-8d22-46ea-9db5-9d4796ee2f8a related: - id: 82880171-b475-4201-b811-e9c826cd5eaa type: similar status: test description: Detects the export of the target Registry key to a file. references: - https://lolbas-project.github.io/lolbas/Binaries/Regedit/ - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f author: Oddvar Moe, Sander Wiebing, oscd.community date: 2020-10-07 modified: 2024-03-13 tags: - attack.exfiltration - attack.discovery - attack.t1012 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \regedit.exe - OriginalFileName: REGEDIT.EXE selection_cli: CommandLine|contains|windash: ' -E ' filter_1: CommandLine|contains: - hklm - hkey_local_machine filter_2: CommandLine|endswith: - \system - \sam - \security condition: all of selection_* and not all of filter_* falsepositives: - Legitimate export of keys level: low
Query: detection rule: Detects the use of TruffleSnout.exe an iterative AD discovery toolkit for offensive operators, situational awareness and
Matching passage: Sigma rule: Detects the use of TruffleSnout.exe an iterative AD discovery toolkit for offensive operators, situational awareness and. Logsource: windows / process_creation. Rule: title: HackTool - TruffleSnout Execution id: 69ca006d-b9a9-47f5-80ff-ecd4d25d481a status: test description: Detects the use of TruffleSnout.exe an iterative AD discovery toolkit for offensive operators, situational awareness and targeted low noise enumeration. references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1482/T1482.md - https://github.com/dsnezhkov/TruffleSnout - https://github.com/dsnezhkov/TruffleSnout/blob/7c2f22e246ef704bc96c396f66fa854e9ca742b9/TruffleSnout/Docs/USAGE.md author: frack113 date: 2022-08-20 modified: 2023-02-13 tags: - attack.discovery - attack.t1482 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: TruffleSnout.exe - Image|endswith: \TruffleSnout.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious launch of a renamed version of the PSEXESVC service with, which is not often used by legitimate admin. Logsource: windows / process_creation. Rule: title: Renamed PsExec Service Execution id: 51ae86a2-e2e1-4097-ad85-c46cb6851de4 status: test description: Detects suspicious launch of a renamed version of the PSEXESVC service with, which is not often used by legitimate administrators references: - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec - https://www.youtube.com/watch?v=ro2QuZTIMBM author: Florian Roth (Nextron Systems) date: 2022-07-21 tags: - attack.execution logsource: category: process_creation product: windows detection: selection: OriginalFileName: psexesvc.exe filter: Image: C:\Windows\PSEXESVC.exe condition: selection and not filter falsepositives: - Legitimate administrative tasks level: high
Query: exploit The ASN.1 signature-verification implementation in the rsa_item_verify function in crypto/rsa/rsa_ameth.c in OpenSSL 1.0.2 before 1.0.2a allows remote attackers to cause a denial o
Matching passage: CVE-2015-0208. CWE: UNKNOWN. CVSS: 4.300000190734863. The ASN.1 signature-verification implementation in the rsa_item_verify function in crypto/rsa/rsa_ameth.c in OpenSSL 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted RSA PSS parameters to an endpoint that uses the certificate-verification feature.
Near-miss passage: CVE-2015-5911. CWE: UNKNOWN. CVSS: 10.0. Multiple unspecified vulnerabilities in Twisted in Wiki Server in Apple OS X Server before 5.0.3 allow attackers to have an unknown impact via an XML document.
Query: describe CVE-2015-2423
Matching passage: CVE-2015-2423. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10, Excel 2007 SP3, PowerPoint 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Visio 2010 SP2, Word 2010 SP2, Excel 2013 SP1, PowerPoint 2013 SP1, Visio 2013 SP1, Word 2013 SP1, Excel 2013 RT SP1, PowerPoint 2013 RT SP1, Visio 2013 RT SP1, Word 2013 RT SP1, and Internet Explorer 7 through 11 allow remote attackers to gain privileges and obtain sensitive information via a crafted command-line parameter to an Office application or Notepad, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Unsafe Command Line Parameter Passing Vulnerability."
Near-miss passage: CVE-2015-2058. CWE: CWE-200. CVSS: 6.5. c2s/c2s.c in Jabber Open Source Server 2.3.2 and earlier truncates data without ensuring it remains valid UTF-8, which allows remote authenticated users to read system memory or possibly have other unspecified impact via a crafted JID.
Query: risk of WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application cras
Matching passage: CVE-2015-5813. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-8981. CWE: CWE-119. CVSS: 9.800000190734863. Heap-based buffer overflow in the PdfParser::ReadXRefSubsection function in base/PdfParser.cpp in PoDoFo allows attackers to have unspecified impact via vectors related to m_offsets.size.
Query: exploit Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gol
Matching passage: CVE-2015-1644. CWE: CWE-264. CVSS: 7.199999809265137. Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Windows MS-DOS Device Name Vulnerability."
Near-miss passage: CVE-2015-4650. CWE: CWE-264. CVSS: 9.800000190734863. Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote attackers to gain shell access and execute arbitrary code with root privileges via unspecified vectors.
Query: describe CVE-2015-5588
Matching passage: CVE-2015-5588. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5575, CVE-2015-5577, CVE-2015-5578, CVE-2015-5580, CVE-2015-5582, and CVE-2015-6677.
Near-miss passage: CVE-2015-9205. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 410/12, SD 615/16/SD 415, SD 808, and SD 810, in a PlayReady API function, a buffer over-read can occur.