BID:11375

Microsoft Windows WMF/EMF Image Format Rendering Remote Buffer Overflow Vulnerability

Info

Microsoft Windows WMF/EMF Image Format Rendering Remote Buffer Overflow Vulnerability

Bugtraq ID:	11375
Class:	Boundary Condition Error
CVE:	CVE-2004-0209
Remote:	Yes
Local:	No
Published:	Oct 12 2004 12:00AM
Updated:	Dec 10 2008 11:51PM
Credit:	Discovery of this issue is credited to Patrick Porlan <[email protected]> and Mark Russinovich of Winternals Software.
Vulnerable:	Microsoft Windows XP Professional SP1 Microsoft Windows XP Professional Microsoft Windows XP Media Center Edition SP1 Microsoft Windows XP Media Center Edition Microsoft Windows XP Home SP1 Microsoft Windows XP Home Microsoft Windows XP 64-bit Edition Version 2003 SP1 Microsoft Windows XP 64-bit Edition Version 2003 Microsoft Windows XP 64-bit Edition SP1 Microsoft Windows XP 64-bit Edition Microsoft Windows Server 2003 Standard x64 Edition Microsoft Windows Server 2003 Enterprise x64 Edition Microsoft Windows Server 2003 Datacenter x64 Edition Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Server SP3 Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Server + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 Microsoft Windows 2000 Professional SP4 Microsoft Windows 2000 Professional SP3 Microsoft Windows 2000 Professional SP2 Microsoft Windows 2000 Professional SP1 Microsoft Windows 2000 Professional Microsoft Windows 2000 Datacenter Server SP4 Microsoft Windows 2000 Datacenter Server SP3 Microsoft Windows 2000 Datacenter Server SP2 Microsoft Windows 2000 Datacenter Server SP1 Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Advanced Server SP4 Microsoft Windows 2000 Advanced Server SP3 Microsoft Windows 2000 Advanced Server SP2 Microsoft Windows 2000 Advanced Server SP1 Microsoft Windows 2000 Advanced Server Avaya S8100 Media Servers R9 Avaya S8100 Media Servers R8 Avaya S8100 Media Servers R7 Avaya S8100 Media Servers R6 Avaya S8100 Media Servers R12 Avaya S8100 Media Servers R11 Avaya S8100 Media Servers R10 Avaya S8100 Media Servers 0 + Microsoft Windows 2000 Server + Microsoft Windows NT Server 4.0 SP6a Avaya S3400 Message Application Server 0 + Microsoft Windows 2000 Server Avaya Modular Messaging (MSS) 2.0 Avaya Modular Messaging (MSS) 1.1 Avaya IP600 Media Servers R9 Avaya IP600 Media Servers R8 Avaya IP600 Media Servers R7 Avaya IP600 Media Servers R6 Avaya IP600 Media Servers R12 Avaya IP600 Media Servers R11 Avaya IP600 Media Servers R10 Avaya IP600 Media Servers Avaya DefinityOne Media Servers R9 Avaya DefinityOne Media Servers R8 Avaya DefinityOne Media Servers R7 Avaya DefinityOne Media Servers R6 Avaya DefinityOne Media Servers R12 Avaya DefinityOne Media Servers R11 Avaya DefinityOne Media Servers R10 Avaya DefinityOne Media Servers

Not Vulnerable:	Microsoft Windows XP Professional SP2 Microsoft Windows XP Home SP2

Discussion

Microsoft Windows WMF/EMF Image Format Rendering Remote Buffer Overflow Vulnerability

Microsoft Windows WMF/EMF image-rendering library is affected by a remote buffer-overflow vulnerability because it fails to properly verify the lengths of strings contained within an affected image file before copying them into finite buffers.

Any code execution that occurs will take place with SYSTEM privileges because of the nature of the affected library. This will also permit local privilege-escalation attacks.

Exploit / POC

Microsoft Windows WMF/EMF Image Format Rendering Remote Buffer Overflow Vulnerability

The following exploit has been made available:

/data/vulnerabilities/exploits/windowsEMF_WMF_Exploit.c

Solution / Fix

Microsoft Windows WMF/EMF Image Format Rendering Remote Buffer Overflow Vulnerability

Solution:
Microsoft has released a bulletin that includes fixes to address this issue for supported versions of the operating system.

Microsoft Windows XP 64-bit Edition SP1