bugtraq - Re: WMF CreateBrushIndirect vulnerability (DoS)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1207145545.20070113121640@mail.ru>
Date: Sat, 13 Jan 2007 12:16:40 +0300
From: temp0_123@...l.ru
To: bugtraq@...urityfocus.com
Subject: Re: WMF CreateBrushIndirect vulnerability (DoS)


> The following WMF exploit appeared on milw0rm today:
> http://www.milw0rm.com/exploits/3111

Another 'old new thing' (i.e. plagiarism):

http://lists.grok.org.uk/pipermail/full-disclosure/2006-August/048530.html
http://lists.grok.org.uk/pipermail/full-disclosure/2006-August/048547.html

> The vulnerability is a result of the WMF parser passing a value from the file as
> a pointer argument to the CreateBrushIndirect function. The function
> dereferences the pointer and dies with an access violation.

> The value in the file is only 16-bit and it is sign extended into a 32-bit
> pointer. This means that we can only access addresses from 0x00000000 to
> 0x0000FFFF and from 0xFFFF0000 to 0xFFFFFFFF. Both of these ranges are always
> invalid, so the vulnerability is just a DoS.

> For more details and some commentary, see:
> http://determina.blogspot.com/2007/01/whats-wrong-with-wmf.html