full-disclosure - Re: [ GLSA 200601-09 ] Wine:Windows MetafileSETABORTPROC vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sun Jan 15 22:39:17 2006
From: pferrie at symantec.com (Peter Ferrie)
Subject: Re: [ GLSA 200601-09 ] Wine:Windows
	MetafileSETABORTPROC vulnerability

>> There is no need for malformed input, though.
>> The description isn't great, since upon return from the function,
>> Windows will resume parsing the records in the usual way.
>
>IDK, but from reading the transcript there is malformed input in the
>form of an invalid record length that Gibson refers to, did you test
>the older metafile processing routines of the GDI, Peter?

Yes, I looked at Windows 3.1 (yes, really), 98, NT4, 2000, and XP.
The code is effective identical in all of those cases.

>It would be interesting to know whether the execution of a new thread
>is triggered by the same circumstances in all versions of Windows.

What's more interesting is Steve's claim of a thread being created.
No thread is created.  The callback is part of the existing code path,
it is called periodically while parsing the file.
Perhaps he meant that the thread is created in order to parse the
WMF file (which is true).

>I also don't know about the assertion of older versions of the GDI
>being vulnerable, but I *do* expect there may be merit in pursuing
>that.

See above - they're all the same.  The difference is only the
registered handler or lack thereof.

>I think Gibson, if what he says is true makes an interesting
>argument concerning  the invalid length == 1 issue.

It would be interesting if it were true, but it's not, so it's not.

>Still, it is hard for me to concieve of this as being anything more
>than a design flaw that as someone said before resulted from 'ease of
>use / feature creep' -- perhaps it was even a requested feature by
>some third-party vendor, who knows?

Like the all-powerful CreateObject() scripting function.

8^) p.