|
Microsoft Windows WMF/EMF File Rendering Arbitrary Code Execution
|
|
Secunia Advisory:
|
SA17498
|
|
|
Release Date:
|
2005-11-08
|
|
Last Update:
|
2006-02-10
|
|
Popularity:
|
24,017 views
|
|
|
Critical:
|
Highly critical
|
|
Impact:
|
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| OS: | Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Datacenter Server
Microsoft Windows 2000 Professional
Microsoft Windows 2000 Server
Microsoft Windows Server 2003 Datacenter Edition
Microsoft Windows Server 2003 Enterprise Edition
Microsoft Windows Server 2003 Standard Edition
Microsoft Windows Server 2003 Web Edition
Microsoft Windows XP Embedded
Microsoft Windows XP Home Edition
Microsoft Windows XP Professional
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2005-2123
CVE-2005-2124
|
|
Description:
Two vulnerabilities have been reported in Microsoft Windows, which can be exploited by malicious people to compromise a vulnerable system.
1) Some integer overflow errors exist in the Graphics Rendering Engine GDI32.DLL (e.g. MRBP16::bCheckRecord) when rendering certain malformed Windows Metafile (WMF) and Enhanced Metafile (EMF) image files. This can be exploited to cause a heap-based buffer overflow and allows arbitrary code execution on a user's system via a specially crafted WMF/EMF file.
2) An integer overflow error exists in the "PlayMetaFileRecord" function of GDI32.DLL when handling the "SetPaletteEntries" records in a Windows Metafile (WMF) image file. This can be exploited to cause a heap-based buffer overflow and allows arbitrary code execution on a user's system via a specially crafted WMF file.
Vulnerability #1 and #2 reportedly affects any program that renders the affected image types and can be exploited by e.g. tricking the user to open a malicious WMF/EMF file, or to view a folder that contains the image.
The vulnerabilities are also reportedly exploitable by embedding the image in an Office document, or by convincing the user to view an HTML email containing an image attachment in Outlook, or via a malicious web site.
Solution:
Apply patches.
Microsoft Windows 2000 (requires SP 4):
http://www.microsoft.com/downloads/de...=F361FCCB-B273-47E7-BB15-BC9C27073446
Microsoft Windows XP (requires SP 1 or SP 2):
http://www.microsoft.com/downloads/de...=E38372B2-3BF6-4393-B9A4-F34248C8073E
Microsoft Windows XP Professional x64 Edition:
http://www.microsoft.com/downloads/de...=086C6878-916C-4A4F-8CA8-A4C0E304FDA4
Microsoft Windows XP Embedded (with SP1):
http://www.microsoft.com/downloads/de...=af116ff1-9347-40d5-b03c-c2c758c652ba
Microsoft Windows XP Embedded (with SP2):
http://www.microsoft.com/downloads/de...=5c635107-a550-45f5-b012-3dfb8893b6a2
Microsoft Windows Server 2003 (with or without SP 1):
http://www.microsoft.com/downloads/de...=CEE3DD3B-3C20-47A9-8BBD-1EA2FBB4AF96
Microsoft Windows Server 2003 (Itanium) (with or without SP 1):
http://www.microsoft.com/downloads/de...=CCFF22BB-ADC4-4974-813C-7721BDB842C0
Microsoft Windows Server 2003 x64 Edition:
http://www.microsoft.com/downloads/de...=F1ADB6E4-0A08-496C-B94C-A1B37178914A
Provided and/or discovered by:
1) eEye Digital Security.
2) Venustech AdDLab, eEye Digital Security, and Peter Ferrie of Symantec Security Response.
Changelog:
2005-11-09: Added information from eEye Digital Security. Updated "Description" and "Original Advisory" sections. Added links to US-CERT vulnerability notes.
2006-02-10: Added patch information for Windows XP Embedded.
Original Advisory:
MS05-053 (KB896424):
http://www.microsoft.com/technet/security/Bulletin/MS05-053.mspx
eEye Digital Security:
http://www.eeye.com/html/research/advisories/AD20051108b.html
http://www.eeye.com/html/research/advisories/AD20051108a.html
Other References:
SA14631:
http://secunia.com/advisories/14631/
US-CERT VU#300549:
http://www.kb.cert.org/vuls/id/300549
US-CERT VU#433341:
http://www.kb.cert.org/vuls/id/433341
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
