Microsoft Windows GDI EMF and WMF Heap Buffer Overflow Vulnerability

Overview

» IDS/IPS Signatures

Security Sites

iPolicy Networks Security Advisory


Date Discovered:	04/09/2008
Severity:	High
Operating Systems Affected:	Microsoft, Windows 2000 SP4 Microsoft, Windows 2003 x64 Microsoft, Windows 2003 SP2 x64 Microsoft, Windows 2003 SP2 Itanium Microsoft, Windows 2003 SP2 Microsoft, Windows 2003 SP1 Itanium Microsoft, Windows 2003 SP1 Microsoft, Windows 2008 x64 Microsoft, Windows 2008 Itanium Microsoft, Windows 2008 Microsoft, Windows Vista SP1 Microsoft, Windows Vista x64 Microsoft, Windows Vista SP1 x64 Microsoft, Windows Vista Microsoft, Windows XP SP2 Pro x64 Microsoft, Windows XP SP2 Microsoft, Windows XP Pro x64

Synopsis

Microsoft Windows graphic device interface (GDI) is vulnerable to an heap-based buffer overflow, caused by improper bounds checking of EMF and WMF image file headers. A remote user can cause arbitrary code to be executed on the target user's system.

Recommended Actions

Update the patches as guided by vendor at :
http://www.microsoft.com/technet/security/bulletin/ms08-021.mspx

Threat Analysis

Microsoft Windows is prone to a heap based overflow vulnerability that resides in the GDI graphics library and can be triggered by a malformed EMF or WMF image file.

A remote user can create a specially crafted EMF or WMF image file that, when loaded by the target user, will trigger a buffer overflow and execute arbitrary code on the target system. The code will run with the privileges of the target user. By persuading a victim to open a specially crafted EMF or WMF file, a remote attacker could overflow a buffer and execute arbitrary code on the system.

References

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1083
http://www.securityfocus.com/bid/28571

Write-up by: Aditya Chaturvedi

Security Sites

“iPolicy is one of the most visionary firewall vendors in the firewall Magic Quadrant. Its architecture of a central session processing engine and multiple content blades that are able to block based on signatures, rules and so on is the closest to the network security ideal.”

Greg Young, John Pescatore
Magic Quadrant for Network Firewalls, 2H04, Gartner

| | | | | | | | |