Microsoft Windows LoadImage API Function Integer Overflow Vulnerability

Bugtraq ID:	12095
Class:	Boundary Condition Error
CVE:	CVE-2004-1049
Remote:	Yes
Local:	No
Published:	Dec 20 2004 12:00AM
Updated:	Dec 10 2008 09:12PM
Credit:	Discovery is credited to flashsky fangxing <[email protected]>.
Vulnerable:	Nortel Networks Symposium Web Client Nortel Networks Symposium Web Center Portal (SWCP) Nortel Networks Symposium TAPI Service Provider Nortel Networks Symposium Network Control Center (NCC) Nortel Networks Symposium Express Call Center (SECC) Nortel Networks Symposium Call Center Server (SCCS) Nortel Networks Symposium Agent Nortel Networks Periphonics Nortel Networks Media Processing Server Nortel Networks MCS 5200 3.0 Nortel Networks MCS 5100 3.0 Nortel Networks IP softphone 2050 Microsoft Windows XP Professional SP1 Microsoft Windows XP Professional Microsoft Windows XP Home SP1 Microsoft Windows XP Home Microsoft Windows Server 2003 Standard x64 Edition Microsoft Windows Server 2003 Enterprise x64 Edition Microsoft Windows Server 2003 Datacenter x64 Edition Microsoft Windows NT Workstation 4.0 SP6a Microsoft Windows NT Workstation 4.0 SP6 Microsoft Windows NT Workstation 4.0 SP5 Microsoft Windows NT Workstation 4.0 SP4 Microsoft Windows NT Workstation 4.0 SP3 Microsoft Windows NT Workstation 4.0 SP2 Microsoft Windows NT Workstation 4.0 SP1 Microsoft Windows NT Workstation 4.0 Microsoft Windows NT Terminal Server 4.0 SP6a Microsoft Windows NT Terminal Server 4.0 SP6 Microsoft Windows NT Terminal Server 4.0 SP5 Microsoft Windows NT Terminal Server 4.0 SP4 Microsoft Windows NT Terminal Server 4.0 SP3 Microsoft Windows NT Terminal Server 4.0 SP2 Microsoft Windows NT Terminal Server 4.0 SP1 Microsoft Windows NT Terminal Server 4.0 Microsoft Windows NT Server 4.0 SP6a + Avaya DefinityOne Media Servers + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 + Avaya S8100 Media Servers 0 Microsoft Windows NT Server 4.0 SP6 Microsoft Windows NT Server 4.0 SP5 Microsoft Windows NT Server 4.0 SP4 Microsoft Windows NT Server 4.0 SP3 Microsoft Windows NT Server 4.0 SP2 Microsoft Windows NT Server 4.0 SP1 Microsoft Windows NT Server 4.0 Microsoft Windows NT Enterprise Server 4.0 SP6a Microsoft Windows NT Enterprise Server 4.0 SP6 Microsoft Windows NT Enterprise Server 4.0 SP5 Microsoft Windows NT Enterprise Server 4.0 SP4 Microsoft Windows NT Enterprise Server 4.0 SP3 Microsoft Windows NT Enterprise Server 4.0 SP2 Microsoft Windows NT Enterprise Server 4.0 SP1 Microsoft Windows NT Enterprise Server 4.0 Microsoft Windows ME Microsoft Windows 98SE Microsoft Windows 98 Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Server SP3 Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Server + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 Microsoft Windows 2000 Professional SP4 Microsoft Windows 2000 Professional SP3 Microsoft Windows 2000 Professional SP2 Microsoft Windows 2000 Professional SP1 Microsoft Windows 2000 Professional Microsoft Windows 2000 Datacenter Server SP4 Microsoft Windows 2000 Datacenter Server SP3 Microsoft Windows 2000 Datacenter Server SP2 Microsoft Windows 2000 Datacenter Server SP1 Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Advanced Server SP4 Microsoft Windows 2000 Advanced Server SP3 Microsoft Windows 2000 Advanced Server SP2 Microsoft Windows 2000 Advanced Server SP1 Microsoft Windows 2000 Advanced Server
Not Vulnerable:	Microsoft Windows XP Tablet PC Edition SP2 Microsoft Windows XP Professional SP2 Microsoft Windows XP Media Center Edition SP2 Microsoft Windows XP Home SP2

Microsoft Windows LoadImage API Function Integer Overflow Vulnerability

Microsoft Windows is prone to a remote integer-overflow vulnerability because it fails to properly ensure that user-supplied input doesn't overflow integer values. Attackers may exploit this issue to cause data to be copied past the end of a memory buffer.

This issue resides in the 'LoadImage' function of the USER32 library. An attacker can exploit this condition by sending a malformed file to a user. If the user opens this file, the integer overflow may occur. A successful attack would occur in the context of the vulnerable user and may allow the attacker to gain unauthorized access to an affected computer.

This vulnerability may be present in applications that import the vulnerable function. At the time of writing, it is not known whether third-party applications are affected by this vulnerability.

Microsoft Windows LoadImage API Function Integer Overflow Vulnerability

A proof-of-concept exploit is available from the following location:

http://www.xfocus.net/flashsky/icoExp/index.html

UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

Microsoft Windows LoadImage API Function Integer Overflow Vulnerability

Solution:
Microsoft has released updates to address this vulnerability on supported platforms.

Please see the references for more information.


Microsoft Windows 98SE

• Microsoft Security Update for Windows 98 and Windows 98 Second Edition (KB891711)
  Slovakian
  http://www.microsoft.com/downloads/details.aspx?FamilyId=6400BF99-378A -4936-88A2-125CB788EA0C&displaylang=sk


• Microsoft Security Update for Windows 98 and Windows 98 Second Edition (KB891711)
  Slovenian
  http://www.microsoft.com/downloads/details.aspx?FamilyId=6400BF99-378A -4936-88A2-125CB788EA0C&displaylang=sl


• Microsoft Security Update for Windows 98 and Windows 98 Second Edition (KB891711)
  Thai
  http://www.microsoft.com/downloads/details.aspx?FamilyId=6400BF99-378A -4936-88A2-125CB788EA0C&displaylang=th

Microsoft Windows NT Server 4.0 SP6a

• Microsoft Security Update for Windows NT Server 4.0 (KB891711)
  http://www.microsoft.com/downloads/details.aspx?familyid=4604400A-287E -48CC-91B1-BEE44EEA588C&displaylang=en

Microsoft Windows NT Terminal Server 4.0 SP6

• Microsoft Security Update for Windows NT 4.0, Terminal Server Edition (KB891711)
  http://www.microsoft.com/downloads/details.aspx?familyid=94A0B521-4C39 -4D15-AA80-068C30476E6F&displaylang=en

Microsoft Windows 2000 Advanced Server SP4

• Microsoft Security Update for Windows 2000 (KB891711)
  http://www.microsoft.com/downloads/details.aspx?familyid=722C6C65-3F6C -4029-8EB7-D4612A785E78&displaylang=en

Microsoft Windows 2000 Professional SP3

• Microsoft Security Update for Windows 2000 (KB891711)
  http://www.microsoft.com/downloads/details.aspx?familyid=722C6C65-3F6C -4029-8EB7-D4612A785E78&displaylang=en

Microsoft Windows 98

• Microsoft Security Update for Windows 98 and Windows 98 Second Edition (KB891711)
  Slovakian
  http://www.microsoft.com/downloads/details.aspx?FamilyId=6400BF99-378A -4936-88A2-125CB788EA0C&displaylang=sk


• Microsoft Security Update for Windows 98 and Windows 98 Second Edition (KB891711)
  Slovenian
  http://www.microsoft.com/downloads/details.aspx?FamilyId=6400BF99-378A -4936-88A2-125CB788EA0C&displaylang=sl


• Microsoft Security Update for Windows 98 and Windows 98 Second Edition (KB891711)
  Thai
  http://www.microsoft.com/downloads/details.aspx?FamilyId=6400BF99-378A -4936-88A2-125CB788EA0C&displaylang=th

Microsoft Windows 2000 Advanced Server SP3

• Microsoft Security Update for Windows 2000 (KB891711)
  http://www.microsoft.com/downloads/details.aspx?familyid=722C6C65-3F6C -4029-8EB7-D4612A785E78&displaylang=en

Microsoft Windows XP Home SP1

• Microsoft Security Update for Windows XP (KB891711)
  http://www.microsoft.com/downloads/details.aspx?familyid=8850954D-57D9 -4D23-9AA1-1CCF6085A057&displaylang=en

Microsoft Windows 2000 Server SP3

• Microsoft Security Update for Windows 2000 (KB891711)
  http://www.microsoft.com/downloads/details.aspx?familyid=722C6C65-3F6C -4029-8EB7-D4612A785E78&displaylang=en

Microsoft Windows NT Enterprise Server 4.0 SP6a

• Microsoft Security Update for Windows NT Server 4.0 (KB891711)
  http://www.microsoft.com/downloads/details.aspx?familyid=4604400A-287E -48CC-91B1-BEE44EEA588C&displaylang=en

Microsoft Windows 2000 Server SP4

• Microsoft Security Update for Windows 2000 (KB891711)
  http://www.microsoft.com/downloads/details.aspx?familyid=722C6C65-3F6C -4029-8EB7-D4612A785E78&displaylang=en

Microsoft Windows 2000 Professional SP4

• Microsoft Security Update for Windows 2000 (KB891711)
  http://www.microsoft.com/downloads/details.aspx?familyid=722C6C65-3F6C -4029-8EB7-D4612A785E78&displaylang=en

Microsoft Windows XP Professional SP1

• Microsoft Security Update for Windows XP (KB891711)
  http://www.microsoft.com/downloads/details.aspx?familyid=8850954D-57D9 -4D23-9AA1-1CCF6085A057&displaylang=en

Microsoft Windows LoadImage API Function Integer Overflow Vulnerability

References:

• Microsoft Security Bulletin MS05-002 (Microsoft)
  
• Technical Cyber Security Alert TA05-012A - Multiple Vulnerabilities in Microsoft (US-CERT)