Microsoft Windows GDI WMF Handling Heap Overflow Vulnerability

Bugtraq ID:	18322
Class:	Boundary Condition Error
CVE:	CVE-2006-2376
Remote:	Yes
Local:	No
Published:	Jun 13 2006 12:00AM
Updated:	Jul 13 2006 11:38PM
Credit:	Discovery is credited to Peter Ferrie of Symantec.
Vulnerable:	Microsoft Windows ME Microsoft Windows 98SE Microsoft Windows 98
Not Vulnerable:

Microsoft Windows GDI WMF Handling Heap Overflow Vulnerability

The Microsoft Windows GDI Graphics Rendering Engine is prone to a heap-overflow vulnerability. This issue is exposed when the component loads a specially crafted WMF (Windows Metafile) image.

If this issue is exploited, a malicious WMF or EMF file could potentially corrupt heap-based memory with attacker-supplied data. This could lead to the execution of arbitrary code and to a complete system compromise.

An attacker could exploit the issue by enticing the victim user to visit a malicious web page that contains the image or to open an email attachment that consists of the image.

This vulnerability is limited to Windows 98/98SE/ME systems.

Microsoft Windows GDI WMF Handling Heap Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]

Microsoft Windows GDI WMF Handling Heap Overflow Vulnerability

Solution:
Microsoft has released a security bulletin to address this issue. Fixes may be obtained through Windows Update.

Microsoft Windows GDI WMF Handling Heap Overflow Vulnerability

References:

• Microsoft Security Bulletin MS06-026 (Microsoft)
  
• Microsoft Windows Update (Microsoft)