bugtraq - Windows GDI+ TIFF memory corruption

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <cacf93c50910140351q3611eb3fp9037155f987bf726@mail.gmail.com>
Date: Wed, 14 Oct 2009 12:51:16 +0200
From: Ivan Fratric <ifsecure@...il.com>
To: bugtraq@...urityfocus.com
Subject: Windows GDI+ TIFF memory corruption

There is a memory corruption vulnerability in TIFF file processing in
Microsoft GDI+ that can be used to crash a vulnerable application and
also to execute arbitrary code.

###################
#The vulnerability#
###################

The vulnerability is caused due to errors in decompression of CCITT G4
compressed TIFF images.

CCITT compression is basically a RLE (Run Length Encoding) compression
of 2-color (black/white) images where run lengths of black and white
pixels are encoded using variable number of bits. In the first step of
decoding process run-lengths are determined and are stored in a buffer
of the same length as image width located on heap. After this process
the values inside the buffer are interpreted as

[white-run-length][black-run-length][white-run-length][black-run-length]...

The process of filling the above buffer continues until the sum of all
run-lengths already written in the buffer is smaller than the image
width.
The vulnerability stems from the fact that, by the encoding mechanism,
a 0-run length is completely valid. Thus, if we specify multiple
run-lengths of zero pixels at the beginning of the image row, we can
escape the buffer boundaries and write arbitrary value after the end
of the buffer.

############
#The impact#
############

This vulnerability can be used to run arbitrary code when an
application using GDI+ is used to open a malformed TIFF file. The code
will be run with the privilages of the vulnerable application.

#####
#PoC#
#####

Due to the spread and the impact of the vulnerability, exploiting
details will not be released at this time.

############
#References#
############

http://ifsec.blogspot.com/2009/10/windows-gdi-tiff-memory-corruption.html
http://www.zerodayinitiative.com/advisories/ZDI-09-072/
http://www.microsoft.com/technet/security/bulletin/ms09-062.mspx
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2503