• 
• 
• 
• 
• 
• 

Research Archives > Security Advisories > AD20070814b

Windows Metafile AttemptWrite Heap Overflow

Release Date:
8/14/2007 12:00:00 AM

Date Reported:
3/27/2007 12:00:00 AM

Severity:
High

Vendor:
Microsoft

Affected Software:
Windows 2000 SP4
Windows XP SP2
Windows Server 2003 SP1

Overview:
eEye Digital Security has discovered a heap overflow vulnerability in the way the Windows Graphical Device Interface (GDI) processes Windows metafiles. If an application attempts to display a malicious metafile in a particular way, a heap overflow will occur and result in the execution of arbitrary code, with the privileges of the user who ran the application.

Technical Details:
The GDI32 function AttemptWrite is susceptible to a heap overflow vulnerability caused by an integer overflow, as depicted in the disassembly below. The AttemptWrite function is called by multiple GDI32 API functions, most notably CreateMetaFileW.

    77F4B519  mov  esi, [ebp+0Ch]  ; reported size of record in bytes
     ...                           ;   (user-controlled)
    77F4B548  mov  eax, [ebx+0Ch]  ; amount of buffer used in bytes
                                   ;   (user-controlled)
    77F4B548  lea  ecx, [eax+esi]  ; *** integer overflow ***
    77F4B54E  cmp  ecx, [ebx+08h]  ; buffer capacity
    77F4B551  ja   _no_memcpy
     ...
    77F4B56D  mov  edi, [ebx]      ; pointer to start of buffer
    77F4B56F  mov  ecx, esi
    77F4B574  add  edi, eax        ; now EDI points to unused buffer space
     ...
    77F4B5BA  mov  eax, ecx
    77F4B5BC  shr  ecx, 2
    77F4B5BF  rep movsd            ; *** complete heap overwrite ***

By constructing a metafile containing an extremely large record length, a complete heap overwrite may occur, due to the intrinsic memcpy attempting to copy roughly 4GB of arbitrary data into a heap block. Because of the size of the copy, an access violation is inevitable, but in programs (such as Microsoft Office applications) that attempt to handle the exception, successful exploitation has been demonstrated.

Protection:
Retina Network Security Scanner has been updated to identify this vulnerability.
Blink Endpoint Vulnerability Prevention preemptively protects from this vulnerability.

Vendor Status:
Microsoft has released Microsoft Security Bulleting MS07-046 for this vulnerability: http://www.microsoft.com/technet/security/Bulletin/MS07-046.mspx

Credit:
Yuji Ukai

Greetings:
fourteenforty.jp

Copyright ©1998-2011 eEye Digital Security
Permission is hereby granted for the redistribution of this alert electronically. It is not to be edited in any way without express consent of eEye. If you wish to reprint the whole or any part of this alert in any other medium excluding electronic medium, please email alert@eEye.com for permission.

Disclaimer
The information within this paper may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are no warranties, implied or express, with regard to this information. In no event shall the author be liable for any direct or indirect damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk.