Microsoft GDI+ Plugin PNG File Infinite Loop Denial of Service Vulnerability

Bugtraq ID:	34586
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Apr 17 2009 12:00AM
Updated:	Apr 17 2009 07:36PM
Credit:	Code Audit Labs
Vulnerable:	Microsoft Windows XP Professional x64 Edition SP3 Microsoft Windows XP Professional x64 Edition SP2 Microsoft Windows XP Professional x64 Edition Microsoft Windows XP Professional SP3 Microsoft Windows XP Professional SP2 Microsoft Windows XP Professional SP1 Microsoft Windows XP Professional Microsoft Windows XP Media Center Edition SP3 Microsoft Windows XP Media Center Edition SP2 Microsoft Windows XP Media Center Edition SP1 Microsoft Windows XP Media Center Edition Microsoft Windows XP Home SP3 Microsoft Windows XP Home SP2 Microsoft Windows XP Home SP1 Microsoft Windows XP Home Microsoft Windows XP Gold 0 Microsoft Windows XP 64-bit Edition SP1 Microsoft Windows XP 64-bit Edition Microsoft Windows XP 0
Not Vulnerable:

Microsoft GDI+ Plugin PNG File Infinite Loop Denial of Service Vulnerability

Microsoft GDI+ is prone to a denial-of-service vulnerability when processing a malformed PNG file.

A remote attacker can exploit this issue to cause an infinite loop, which will consume processing resources, denying service to legitimate users.

Microsoft GDI+ Plugin PNG File Infinite Loop Denial of Service Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to open a specially crafted PNG file.

The following PNG file generator is available:

• /data/vulnerabilities/exploits/34586.pl

Microsoft GDI+ Plugin PNG File Infinite Loop Denial of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft GDI+ Plugin PNG File Infinite Loop Denial of Service Vulnerability

References:

• Microsoft Windows Homepage (Microsoft )