Microsoft GDI+ 'GDIPLUS.dll' ICO File Divide-By-Zero Denial of Service Vulnerability
BID:31432
Info
Microsoft GDI+ 'GDIPLUS.dll' ICO File Divide-By-Zero Denial of Service Vulnerability
| Bugtraq ID: | 31432 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: |
CVE-2008-4327 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 26 2008 12:00AM |
| Updated: | May 07 2015 05:23PM |
| Credit: | laurent gaffie |
| Vulnerable: |
Microsoft Windows XP Professional x64 Edition SP3 Microsoft Windows XP Professional x64 Edition SP2 Microsoft Windows XP Professional x64 Edition Microsoft Windows XP Professional SP3 Microsoft Windows XP Professional SP2 Microsoft Windows XP Professional SP1 Microsoft Windows XP Professional Microsoft Windows XP Media Center Edition SP3 Microsoft Windows XP Media Center Edition SP2 Microsoft Windows XP Media Center Edition SP1 Microsoft Windows XP Media Center Edition Microsoft Windows XP Home SP3 Microsoft Windows XP Home SP2 Microsoft Windows XP Home SP1 Microsoft Windows XP Home Microsoft Windows XP Gold 0 Microsoft Windows XP 64-bit Edition SP1 Microsoft Windows XP 64-bit Edition Microsoft Windows XP 0 |
| Not Vulnerable: | |
Discussion
Microsoft GDI+ 'GDIPLUS.dll' ICO File Divide-By-Zero Denial of Service Vulnerability
Microsoft GDI+ is prone to a denial-of-service vulnerability when processing a malformed ICO file.
A remote attacker can exploit this issue to crash the affected application, denying service to legitimate users.
Microsoft GDI+ is prone to a denial-of-service vulnerability when processing a malformed ICO file.
A remote attacker can exploit this issue to crash the affected application, denying service to legitimate users.
Exploit / POC
Microsoft GDI+ 'GDIPLUS.dll' ICO File Divide-By-Zero Denial of Service Vulnerability
To exploit this issue, an attacker must entice an unsuspecting user to open a maliciously crafted ICO file.
The following proof-of-concept ICO file generator is available:
To exploit this issue, an attacker must entice an unsuspecting user to open a maliciously crafted ICO file.
The following proof-of-concept ICO file generator is available:
Solution / Fix
Microsoft GDI+ 'GDIPLUS.dll' ICO File Divide-By-Zero Denial of Service Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Microsoft GDI+ 'GDIPLUS.dll' ICO File Divide-By-Zero Denial of Service Vulnerability
References:
References:
- Microsoft Windows Homepage (Microsoft )