Security Advisory SA42779 - Microsoft Windows Thumbnail Bitmap Parsing Buffer Overflow

Secunia

Blog

Secunia Advisory SA42779

Microsoft Windows Thumbnail Bitmap Parsing Buffer Overflow

Secunia Advisory

SA42779

Release Date

2011-01-05

Last Update

2011-02-09

Popularity

14,796 views

Comments

2 comments

Criticality level

Extremely critical

Impact

System access

Where

From remote

Authentication level

This information is available to Secunia VIM customers

Report reliability

This information is available to Secunia VIM customers

Solution Status

Vendor Patch

Systems affected

This information is available to Secunia VIM customers

Approve distribution

This information is available to Secunia VIM customers

Remediation status

Secunia CSI, Secunia PSI

Automated scanning

Secunia CSI, Secunia PSI

Operating System

Microsoft Windows Server 2003 Datacenter Edition

Microsoft Windows Server 2003 Enterprise Edition

Microsoft Windows Server 2003 Standard Edition

Microsoft Windows Server 2003 Web Edition

Microsoft Windows Server 2008

Microsoft Windows Storage Server 2003

Microsoft Windows Vista

Microsoft Windows XP Home Edition

Microsoft Windows XP Professional

Secunia CVSS Score

This information is available to Secunia VIM Customers

CVE Reference(s)

CVE-2010-3970 CVSS score available to Secunia VIM customers

Description

A vulnerability has been reported in Microsoft Windows, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a signedness error in the "CreateSizedDIBSECTION()" function within the Windows Shell graphics processor (shimgvw.dll) when parsing thumbnail bitmaps. This can be exploited to cause a stack-based buffer overflow via a specially crafted thumbnail image containing a negative "biClrUsed" value.

Successful exploitation allows execution of arbitrary code when a user e.g. views a malicious web page or Office document.

Solution
Apply patches.
Further details available to Secunia VIM customers

Provided and/or discovered by
Moti and Xu Hao at POC2010

Changelog
Further details available to Secunia VIM customers

Original Advisory
MS11-006 (KB2483185):
http://www.microsoft.com/technet/security/Bulletin/MS11-006.mspx

Metasploit:
http://www.metasploit.com/redmine/projects/framework/repository/revisions/11466/entry/modules/exploits/windows/fileformat/ms11_xxx_createsizeddibsection.rb

Other references
Further details available to Secunia VIM customers

Technical Analysis
Further details available to Secunia VIM customers

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers

Do you have additional information related to this advisory?

Please provide information about patches, mitigating factors, new versions, exploits, faulty patches, links, and other relevant data by posting comments to this Advisory. You can also send this information to vuln@secunia.com

Subject: Microsoft Windows Thumbnail Bitmap Parsing Buffer Overflow

User

Message

irsdl

RE: Microsoft Windows Thumbnail Bitmap Parsing Buffer Overflow

6th Jan, 2011 12:11

Score: 12
Posts: 10
User Since: 16th Jul 2010
System Score: N/A
Location: UK
Last edited on 6th Jan, 2011 12:11

Microsoft quick workaround has been added: http://support.microsoft.com/kb/2490606

--
------
Soroush Dalili
soroush.secproject.com/blog/

Was this reply relevant?

-0

dS0nne

RE: Microsoft Windows Thumbnail Bitmap Parsing Buffer Overflow

11th Jan, 2011 00:26

Score: 0
Posts: 1
User Since: 11th Jan 2011
System Score: N/A
Location: FI
Last edited on 11th Jan, 2011 00:26

Am I confused, or doesn't this vulnerability require you to browse a remote share with Windows Explorer to be remotely exploited? Look at what MS says. It doesn't look like any malicious web site could exploit it, like with a malicious image on the site etc. They'd have to link to a remote share for you to open for viewing in Windows Explorer, or con you into opening a bad Office file...

http://www.microsoft.com/security/portal/Threat/En...
Exploitation can occur by simply browsing to a folder containing the malicious file - no further user interaction is required. Exploitation can also be achieved remotely, if the user is enticed to view the folder of a remote machine (such as clicking on a link that leads to a remote share) that contains the exploit. The link can be sent via e-mail or shown in a web page.

http://blogs.technet.com/b/srd/archive/2011/01/07/...
Proof-of-concept code we have seen so far requires a user to browse to an attacker-writable folder using Windows Explorer. If Explorer is set to display thumbnails or a preview of contained files (neither setting is the default), the chance of code execution exists. Current proof-of-concept code is not successful when Explorer is set to display files in the default List mode.

Was this reply relevant?

-0

Secunia Advisory SA42779

Microsoft Windows Thumbnail Bitmap Parsing Buffer Overflow

Do you have additional information related to this advisory?

You must be logged in to post a comment.

Secunia Customer Login

Not a customer already?