Microsoft Internet Explorer WMF Image Parsing Memory Corruption Vulnerability

Bugtraq ID:	16516
Class:	Boundary Condition Error
CVE:	CVE-2006-0020
Remote:	Yes
Local:	No
Published:	Jan 09 2006 12:00AM
Updated:	Apr 07 2006 03:38PM
Credit:	Discovered by H D Moore.
Vulnerable:	Nortel Networks Self-Service Peri NT Server 0 Nortel Networks Self-Service Peri IVR 0 Nortel Networks Self-Service Media Processing Server 0 Nortel Networks Optivity Telephony Manager TM-CS1000 0 Nortel Networks MCS 5200 3.0 Nortel Networks MCS 5100 3.0 Nortel Networks IP softphone 2050 Nortel Networks IP Address Domain Manager Nortel Networks Contact Center Microsoft Internet Explorer 5.0.1 SP4 - Microsoft Windows 2000 Advanced Server SP4 - Microsoft Windows 2000 Datacenter Server SP4 - Microsoft Windows 2000 Professional SP4 - Microsoft Windows 2000 Server SP4 Avaya Unified Communications Center S3400 Avaya S8100 Media Servers R9 Avaya S8100 Media Servers R8 Avaya S8100 Media Servers R7 Avaya S8100 Media Servers R6 Avaya S8100 Media Servers R12 Avaya S8100 Media Servers R11 Avaya S8100 Media Servers R10 Avaya S8100 Media Servers 0 + Microsoft Windows 2000 Server + Microsoft Windows NT Server 4.0 SP6a Avaya Modular Messaging (MAS) Avaya IP600 Media Servers R9 Avaya IP600 Media Servers R8 Avaya IP600 Media Servers R7 Avaya IP600 Media Servers R6 Avaya IP600 Media Servers R12 Avaya IP600 Media Servers R11 Avaya IP600 Media Servers R10 Avaya IP600 Media Servers Avaya DefinityOne Media Servers R9 Avaya DefinityOne Media Servers R8 Avaya DefinityOne Media Servers R7 Avaya DefinityOne Media Servers R6 Avaya DefinityOne Media Servers R12 Avaya DefinityOne Media Servers R11 Avaya DefinityOne Media Servers R10 Avaya DefinityOne Media Servers
Not Vulnerable:	Microsoft Internet Explorer 6.0 SP1

Microsoft Internet Explorer WMF Image Parsing Memory Corruption Vulnerability

Microsoft Internet Explorer is affected by an WMF image-parsing memory-corruption vulnerability. This issue is allegedly due to an integer-overflow flaw that leads to corrupted heap memory.

This problem presents itself when a user views a malicious WMF-formatted file containing specially crafted data.

This issue allows remote attackers to execute arbitrary machine code in the context of the affected application. Failed exploitation attempts likely result in crashing the application.

Microsoft Internet Explorer WMF Image Parsing Memory Corruption Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Microsoft Internet Explorer WMF Image Parsing Memory Corruption Vulnerability

Solution:
Microsoft has released advisory MS06-004 to address this issue. Please see the referenced advisory for further information.

Avaya has released an advisory to identify vulnerable products, and recommends that users apply patches released by Microsoft.


Microsoft Internet Explorer 5.0.1 SP4

• Microsoft Cumulative Security Update for Internet Explorer (910620)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=C0DF2FC3-2075 -46B5-945F-6E0BD6806151

Microsoft Internet Explorer WMF Image Parsing Memory Corruption Vulnerability

References:

• [ BULLETIN ] NORTEL RESPONSE TO MICROSOFT SECURITY BULLETIN MS06-004 (Nortel Networks)
  
• [funsec] Another WMF flaw without a Microsoft patch (H D Moore)
  
• ASA-2006-047 - Windows Security Updates for February 2006 - (MS06-004 to MS06-01 (Avaya)
  
• Microsoft Knowledge Base Article 910620 (Microsoft)
  
• Microsoft Security Advisory (913333) (Microsoft)
  
• Microsoft Security Bulletin MS06-004 (Microsoft)
  
• Technet Security (Microsoft)