CERT-In Advisory
CIAD-2005-0024
Microsoft Windows Image File Rendering Vulnerabilities
Original Issue Date: November 09, 2005
Severity Rating: High
Systems Affected
- Microsoft Windows 2000 Service Pack 4
- Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2
- Microsoft Windows XP Professional x64 Edition
- Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1
- Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems
- Microsoft Windows Server 2003 x64 Edition
Overview
Multiple vulnerabilities have been reported in Microsoft Windows graphics rendering services which could allow a remote attacker to execute arbitrary code or cause a denial of service on a vulnerable system.
Description
1. Graphics Rendering Engine Vulnerability
(
CAN-2005-2123
)
This vulnerability exists in the way the Windows Graphical Device Interface GDI process EMF and WMF file. Microsoft Windows use GDI32.DLL file to render the EMF/WMF file. This GDI32.DLL file contains integer overflow flaws which could caused heap overflow through any number of specially crafted metafile structures
2. Windows Metafile Vulnerability
(
CAN-2005-2124
)
A remote code execution vulnerability exists in the way the Windows Graphical Device Interface GDI process Windows Metafile WMF image format. To exploit this vulnerability an attacker sends malicious Meta file via email or a link to a webpage and convince the user to open the file. An attacker who successfully exploited this vulnerability could remotely take complete control of an affected system.
3. Enhanced Metafile Vulnerability
(
CAN-2005-0803
)
A denial of service vulnerability exists in the way the Windows Graphical Device Interface GDI process Enhanced Metafile EMF image format. To exploit this vulnerability an attacker sends malicious Meta file via email or a link to a webpage and convince the user to open the file.
Solution
Apply appropriate security update mentioned in Microsoft Security Bulletin
MS05-053.
Workaround
Read e-mail messages in plain text format to protect from the HTML based e-mail attacks.
Vendor Information
Microsoft
http://www.microsoft.com/technet/security/Bulletin/MS05-053.mspx
References
US-CERT TA05-312A
http://www.us-cert.gov/cas/techalerts/TA05-312A.html
Secunia Advisory:SA17498
http://secunia.com/advisories/17498/
eEye Digital Security
http://www.eeye.com/html/research/advisories/AD20051108a.html
http://www.eeye.com/html/research/advisories/AD20051108b.html
CVE Name
CAN-2005-2123
CAN-2005-2124
CAN-2005-0803
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|