BugTraq
WMF CreateBrushIndirect vulnerability (DoS) Jan 11 2007 03:23AM
Alexander Sotirov (asotirov determina com) (1 replies)
The following WMF exploit appeared on milw0rm today:
http://www.milw0rm.com/exploits/3111

The vulnerability is a result of the WMF parser passing a value from the file as
a pointer argument to the CreateBrushIndirect function. The function
dereferences the pointer and dies with an access violation.

The value in the file is only 16-bit and it is sign extended into a 32-bit
pointer. This means that we can only access addresses from 0x00000000 to
0x0000FFFF and from 0xFFFF0000 to 0xFFFFFFFF. Both of these ranges are always
invalid, so the vulnerability is just a DoS.

For more details and some commentary, see:
http://determina.blogspot.com/2007/01/whats-wrong-with-wmf.html

Alexander Sotirov
Determina Security Research

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Cygwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFFpa2lTS+0yyhMJeMRAsK9AKCUNE/rE3ONA4GSK7ZyTGJzfRIUzgCeM9yj
RRjwWykUJKN2lacvDpf0LGU=
=xokA
-----END PGP SIGNATURE-----

[ reply ]
Re: WMF CreateBrushIndirect vulnerability (DoS) Jan 13 2007 09:16AM
temp0_123 mail ru


 

Privacy Statement
Copyright 2010, SecurityFocus