Windows Metafile AttemptWrite Heap Overflow
Release Date:
August 14, 2007
Date Reported:
March 27, 2007
Severity:
High (Code Execution)
Systems Affected:
Windows 2000 SP4
Windows XP SP2
Windows Server 2003 SP1
Overview:
eEye Digital Security has discovered a heap overflow vulnerability in
the way the Windows Graphical Device Interface (GDI) processes Windows
metafiles. If an application attempts to display a malicious metafile
in a particular way, a heap overflow will occur and result in the
execution of arbitrary code, with the privileges of the user who ran the
application.
Technical Details:
The GDI32 function AttemptWrite is susceptible to a heap overflow
vulnerability caused by an integer overflow, as depicted in the
disassembly below. The AttemptWrite function is called by multiple
GDI32 API functions, most notably CreateMetaFileW.
77F4B519 mov esi, [ebp+0Ch] ; reported size of record in bytes
... ; (user-controlled)
77F4B548 mov eax, [ebx+0Ch] ; amount of buffer used in bytes
; (user-controlled)
77F4B548 lea ecx, [eax+esi] ; *** integer overflow ***
77F4B54E cmp ecx, [ebx+08h] ; buffer capacity
77F4B551 ja _no_memcpy
...
77F4B56D mov edi, [ebx] ; pointer to start of buffer
77F4B56F mov ecx, esi
77F4B574 add edi, eax ; now EDI points to unused buffer
space
...
77F4B5BA mov eax, ecx
77F4B5BC shr ecx, 2
77F4B5BF rep movsd ; *** complete heap overwrite ***
By constructing a metafile containing an extremely large record length,
a complete heap overwrite may occur, due to the intrinsic memcpy
attempting to copy roughly 4GB of arbitrary data into a heap block.
Because of the size of the copy, an access violation is inevitable, but
in programs (such as Microsoft Office applications) that attempt to
handle the exception, successful exploitation has been demonstrated.
Protection:
Retina Network Security Scanner has been updated to identify this
vulnerability.
Blink Endpoint Vulnerability Prevention preemptively protects from this
vulnerability.
Vendor Status:
Microsoft has released a patch for this vulnerability. The patch is
available at:
http://www.microsoft.com/technet/security/bulletin/MS07-046.mspx
Credit:
Yuji Ukai
Related Links:
Retina - Network Security Scanner - Free Trial:
http://www.eeye.com/html/products/retina/download/index.html
Blink - Unified Client Security Personal - Free For Home Use:
http://www.eeye.com/html/products/blink/personal/download/index.html
Blink - Unified Client Security Professional - Free Trial:
http://www.eeye.com/html/products/blink/download/index.html
Greetings:
fourteenforty.jp
Copyright (c) 1998-2007 eEye Digital Security
Permission is hereby granted for the redistribution of this alert
electronically. It is not to be edited in any way without express
consent of eEye. If you wish to reprint the whole or any part of this
alert in any other medium excluding electronic medium, please email
alert@xxxxxxxx for permission.
Disclaimer
The information within this paper may change without notice. Use of
this information constitutes acceptance for use in an AS IS condition.
There are no warranties, implied or express, with regard to this
information. In no event shall the author be liable for any direct or
indirect damages whatsoever arising out of or in connection with the use
or spread of this information. Any use of this information is at the
user's own risk.
