BugTraq
More information on ZERT patch for ANI 0day Apr 02 2007 02:19AM
Gadi Evron (ge linuxbox org) (1 replies)
Hi, more information about the patch released April 1st can be found here:

http://zert.isotf.org/

Including:
1. Technical information.
2. Why this patch was released when eeye already released a third party
patch.

The newly discovered zero-day vulnerability in the parsing of animated
cursors is very similar to the one previously discovered by eEye that was
patched by Microsoft in MS05-002. Basically an "anih" chunk in an animated
cursor RIFF file is read into a stack buffer of a fixed size (36
bytes) but the actual memory copy operation uses the length field provided
inside the "anih" chunk.giving an attacker an easy route to overflow the
stack and gain control of the execution of the process.

With the MS05-002 patch, Microsoft added a check for the length of the
chunk before copying it to the buffer. However, they neglected to audit
the rest of the code for any other instances of the vulnerable copy
routine. As it turns out, if there are two "anih" chunks in the file, the
second chunk will be handled by a separate piece of code which Microsoft
did not fix. This is what the authors of the zero-day discovered.

Although eEye has released a third-party patch that will prevent the
latest exploit from working, it doesn't fix the flawed copy routine. It
simply requires that any cursors loaded must reside within the Windows
directory (typically C:\WINDOWS\ or C:\WINNT\). This approach should
successfully mitigate most "drive-by's," but might be bypassed by an
attacker with access to this directory.

For this reason, ZERT is releasing a patch which addresses the core of the
vulnerability, by ensuring that no more than 36 bytes of an "anih" chunk
will be copied to the stack buffer, thus eliminating all potential exploit
paths while maintaining compatibility with well-formatted animated cursor
files.

Gadi.

[ reply ]
Re: More information on ZERT patch for ANI 0day Apr 03 2007 07:42AM
Stefan Kelm (stefan kelm secorvo de) (2 replies)
Re: More information on ZERT patch for ANI 0day Apr 03 2007 06:52PM
Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP] (sbradcpa pacbell net) (1 replies)
Re: More information on ZERT patch for ANI 0day Apr 04 2007 01:20AM
Jason Frisvold (xenophage0 gmail com) (1 replies)
Re: More information on ZERT patch for ANI 0day Apr 04 2007 01:27AM
Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP] (sbradcpa pacbell net)
Re: [Full-disclosure] More information on ZERT patch for ANI 0day Apr 03 2007 05:32PM
Matthew Murphy (mattmurphy kc rr com)


 

Privacy Statement
Copyright 2010, SecurityFocus