CERT-In Vulnerability Note
CIVN-2007-0129
Microsoft Windows Kodak Image Viewer Remote Code Execution Vulnerability
Original Issue Date:October 10, 2007
Severity Rating: HIGH
Systems Affected
Microsoft Windows 2000 Advanced Server Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Professional Microsoft Windows 2000 Server Microsoft Windows Server 2003 Datacenter Edition Microsoft Windows Server 2003 Enterprise Edition Microsoft Windows Server 2003 Standard Edition Microsoft Windows Server 2003 Web Edition Microsoft Windows XP Home Edition Microsoft Windows XP Professional
Overview
A vulnerability has been reported in Kodak Image Viewer in Microsoft Windows that could be exploited by an attacker to take complete control of the vulnerable system.
Description
The vulnerability is caused due to an error in Kodak Image Viewer while processing specially crafted image files. Successful exploitation corrupts system memory and allows execution of arbitrary code.
The attacker could exploit these vulnerabilities by creating and hosting a specially crafted web site containing contents to exploit the vulnerability and could persuade the user to visit the website typically by getting them click on a link to the website or could send malicious image files in email attachment. Opening such malicious image file could corrupt the system memory and allow attacker to execute arbitrary code.
Workaround
Read e-mail messages in plain text format to help protect system from the HTML e-mail attack vector
Modify the access control list on oieng400.dll
Solution
Apply appropriate patches as mentioned in Microsoft Security Bulletin
MS07-055
Vendor Information
Microsoft
http://www.microsoft.com/technet/security/Bulletin/MS07-055.mspx
References
Microsoft
http://www.microsoft.com/technet/security/Bulletin/MS07-055.mspx
Secunia
http://secunia.com/advisories/27092/
CVE Name
CVE-2007-2217
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-2436857
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|