Date: Tue, 14 Aug 2007 12:47:20 -0700
From: "eEye Advisories" <eEyeAdvisories@...e.com>
To: <Full-Disclosure@...ts.grok.org.uk>
Subject: EEYE: Windows Metafile AttemptWrite Heap Overflow

Windows Metafile AttemptWrite Heap Overflow

Release Date:
August 14, 2007

Date Reported:
March 27, 2007

Severity:
High (Code Execution)

Systems Affected:
Windows 2000 SP4
Windows XP SP2
Windows Server 2003 SP1

Overview:
eEye Digital Security has discovered a heap overflow vulnerability in
the way the Windows Graphical Device Interface (GDI) processes Windows
metafiles.  If an application attempts to display a malicious metafile
in a particular way, a heap overflow will occur and result in the
execution of arbitrary code, with the privileges of the user who ran the
application.

Technical Details:
The GDI32 function AttemptWrite is susceptible to a heap overflow
vulnerability caused by an integer overflow, as depicted in the
disassembly below.  The AttemptWrite function is called by multiple
GDI32 API functions, most notably CreateMetaFileW.

    77F4B519  mov  esi, [ebp+0Ch]  ; reported size of record in bytes
     ...                           ;   (user-controlled)
    77F4B548  mov  eax, [ebx+0Ch]  ; amount of buffer used in bytes
                                   ;   (user-controlled)
    77F4B548  lea  ecx, [eax+esi]  ; *** integer overflow ***
    77F4B54E  cmp  ecx, [ebx+08h]  ; buffer capacity
    77F4B551  ja   _no_memcpy
     ...
    77F4B56D  mov  edi, [ebx]      ; pointer to start of buffer
    77F4B56F  mov  ecx, esi
    77F4B574  add  edi, eax        ; now EDI points to unused buffer
space
     ...
    77F4B5BA  mov  eax, ecx
    77F4B5BC  shr  ecx, 2
    77F4B5BF  rep movsd            ; *** complete heap overwrite ***

By constructing a metafile containing an extremely large record length,
a complete heap overwrite may occur, due to the intrinsic memcpy
attempting to copy roughly 4GB of arbitrary data into a heap block.
Because of the size of the copy, an access violation is inevitable, but
in programs (such as Microsoft Office applications) that attempt to
handle the exception, successful exploitation has been demonstrated.

Protection:
Retina Network Security Scanner has been updated to identify this
vulnerability.
Blink Endpoint Vulnerability Prevention preemptively protects from this
vulnerability.

Vendor Status:
Microsoft has released a patch for this vulnerability.  The patch is
available at:
http://www.microsoft.com/technet/security/bulletin/MS07-046.mspx

Credit:
Yuji Ukai

Related Links:
Retina - Network Security Scanner - Free Trial:
http://www.eeye.com/html/products/retina/download/index.html
Blink - Unified Client Security Personal - Free For Home Use:
http://www.eeye.com/html/products/blink/personal/download/index.html
Blink - Unified Client Security Professional - Free Trial:
http://www.eeye.com/html/products/blink/download/index.html

Greetings:
fourteenforty.jp

Copyright (c) 1998-2007 eEye Digital Security
Permission is hereby granted for the redistribution of this alert
electronically.  It is not to be edited in any way without express
consent of eEye.  If you wish to reprint the whole or any part of this
alert in any other medium excluding electronic medium, please email
alert@...e.com for permission.

Disclaimer
The information within this paper may change without notice.  Use of
this information constitutes acceptance for use in an AS IS condition.
There are no warranties, implied or express, with regard to this
information.  In no event shall the author be liable for any direct or
indirect damages whatsoever arising out of or in connection with the use
or spread of this information.  Any use of this information is at the
user's own risk.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists