Microsoft Windows CE Pocket Internet Explorer PNG Denial of Service Vulnerability

Bugtraq ID:	24420
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	May 27 2005 12:00AM
Updated:	Jun 12 2007 04:59PM
Credit:	The vendor disclosed this issue. Ollie Whitehouse is credited with reporting this issue as a security vulnerability.
Vulnerable:	Microsoft Windows CE 4.2
Not Vulnerable:

Microsoft Windows CE Pocket Internet Explorer PNG Denial of Service Vulnerability

Windows CE Pocket Internet Explorer is vulnerable to a denial-of-service vulnerability.

An attacker can exploit this issue to cause an exception that may crash the browser.

Windows CE 4.2 is vulnerable; other versions may also be affected.

Microsoft Windows CE Pocket Internet Explorer PNG Denial of Service Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to open a webpage containing a specially crafted PNG file.

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

Microsoft Windows CE Pocket Internet Explorer PNG Denial of Service Vulnerability

Solution:
The vendor recognizes this issue as a bug and has released a fix. Please see the references for more information.

Microsoft Windows CE Pocket Internet Explorer PNG Denial of Service Vulnerability

References:

• FIX: An exception may occur when Pocket Internet Explorer loads PNG format image (Microsoft)
  
• KB837392 - How to locate core operating system fixes for Microsoft Windows CE Pl (Microsoft)
  
• Microsoft Windows CE Homepage (Microsoft)
  
• The Elephant Under the Carpet (and when I say "carpet" I mean PDA) (Ollie Whitehouse)