lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 13 Jan 2007 12:16:40 +0300
Subject: Re: WMF CreateBrushIndirect vulnerability (DoS)

> The following WMF exploit appeared on milw0rm today:

Another 'old new thing' (i.e. plagiarism):

> The vulnerability is a result of the WMF parser passing a value from the file as
> a pointer argument to the CreateBrushIndirect function. The function
> dereferences the pointer and dies with an access violation.

> The value in the file is only 16-bit and it is sign extended into a 32-bit
> pointer. This means that we can only access addresses from 0x00000000 to
> 0x0000FFFF and from 0xFFFF0000 to 0xFFFFFFFF. Both of these ranges are always
> invalid, so the vulnerability is just a DoS.

> For more details and some commentary, see:

Powered by blists - more mailing lists