BID:14214

Microsoft Windows Color Management Module ICC Profile Buffer Overflow Vulnerability

Info

Microsoft Windows Color Management Module ICC Profile Buffer Overflow Vulnerability

Bugtraq ID:	14214
Class:	Boundary Condition Error
CVE:	CVE-2005-1219
Remote:	Yes
Local:	No
Published:	Jul 12 2005 12:00AM
Updated:	Nov 02 2007 10:06PM
Credit:	Discovery is credited to Shih-hao Weng of Information & Communication Security Technology Center (ICST).
Vulnerable:	Nortel Networks Centrex IP Client Manager Microsoft Windows XP Tablet PC Edition SP2 Microsoft Windows XP Tablet PC Edition SP1 Microsoft Windows XP Tablet PC Edition Microsoft Windows XP Professional x64 Edition Microsoft Windows XP Professional SP2 Microsoft Windows XP Professional SP1 Microsoft Windows XP Professional Microsoft Windows XP Media Center Edition SP2 Microsoft Windows XP Media Center Edition SP1 Microsoft Windows XP Media Center Edition Microsoft Windows XP Home SP2 Microsoft Windows XP Home SP1 Microsoft Windows XP Home Microsoft Windows XP 64-bit Edition Version 2003 SP1 Microsoft Windows XP 64-bit Edition Version 2003 Microsoft Windows XP 64-bit Edition SP1 Microsoft Windows XP 64-bit Edition Microsoft Windows Server 2003 Web Edition SP1 Microsoft Windows Server 2003 Web Edition Microsoft Windows Server 2003 Standard x64 Edition Microsoft Windows Server 2003 Standard Edition SP1 Microsoft Windows Server 2003 Standard Edition Microsoft Windows Server 2003 Enterprise x64 Edition Microsoft Windows Server 2003 Enterprise Edition Itanium SP1 Microsoft Windows Server 2003 Enterprise Edition Itanium 0 Microsoft Windows Server 2003 Enterprise Edition SP1 Microsoft Windows Server 2003 Enterprise Edition Microsoft Windows Server 2003 Datacenter x64 Edition Microsoft Windows Server 2003 Datacenter Edition Itanium SP1 Microsoft Windows Server 2003 Datacenter Edition Itanium 0 Microsoft Windows Server 2003 Datacenter Edition SP1 Microsoft Windows Server 2003 Datacenter Edition Microsoft Windows ME Microsoft Windows 98SE Microsoft Windows 98 Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Server SP3 Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Server + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 Microsoft Windows 2000 Professional SP4 Microsoft Windows 2000 Professional SP3 Microsoft Windows 2000 Professional SP2 Microsoft Windows 2000 Professional SP1 Microsoft Windows 2000 Professional Microsoft Windows 2000 Datacenter Server SP4 Microsoft Windows 2000 Datacenter Server SP3 Microsoft Windows 2000 Datacenter Server SP2 Microsoft Windows 2000 Datacenter Server SP1 Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Advanced Server SP4 Microsoft Windows 2000 Advanced Server SP3 Microsoft Windows 2000 Advanced Server SP2 Microsoft Windows 2000 Advanced Server SP1 Microsoft Windows 2000 Advanced Server

Not Vulnerable:

Discussion

Microsoft Windows Color Management Module ICC Profile Buffer Overflow Vulnerability

Microsoft Windows is prone to a buffer-overflow vulnerability in the Color Management Module. The issue is due to a boundary-condition error related to the parsing of ICC (International Color Consortium) Profile tags in various supported image and document formats.

ICC Profile data may possibly be embedded in various file formats, including JPEG, GIF, EXIF, TIFF, PNG, PICT, PDF, PostScript, SVG, JDF, and CSS3. Some of these formats may not provide an attack vector, especially if Microsoft doesn't provide native support or doesn't call the vulnerable functionality when handling certain formats.

Successful exploitation may result in the execution of arbitrary code in the context of the currently logged-in user. An attacker could exploit this vulnerability by posting a malicious document on a website, by sending malicious content via email, or through other means.

There is also a risk that other Microsoft or third-party applications that rely on the affected functionality may be vulnerable. Since a number of third-party applications may ship with vulnerable libraries, they may remain vulnerable despite having applied the Microsoft patch. Symantec is not aware of any such vendors at the time of writing.

Exploit / POC

Microsoft Windows Color Management Module ICC Profile Buffer Overflow Vulnerability

Microsoft has stated that they have received reports that this vulnerability has been exploited in the wild.

Exploit code (ms_icc_exp.c) has been provided by snooq.

UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

/data/vulnerabilities/exploits/icc_exp.c
/data/vulnerabilities/exploits/ms_icc_exp.c

Solution / Fix

Microsoft Windows Color Management Module ICC Profile Buffer Overflow Vulnerability

Solution:
Microsoft has released patches to address this vulnerability in supported platforms.

Nortel has released bulletin number 2005006061 describing vulnerable packages. Fixes are not currently available. Please see the referenced document for more information.

Microsoft Windows Server 2003 Datacenter x64 Edition