BID:36650

Microsoft GDI+ Malformed Office Object Memory Corruption Remote Code Execution Vulnerability

Info

Microsoft GDI+ Malformed Office Object Memory Corruption Remote Code Execution Vulnerability

Bugtraq ID:	36650
Class:	Boundary Condition Error
CVE:	CVE-2009-2528
Remote:	Yes
Local:	No
Published:	Oct 13 2009 12:00AM
Updated:	Oct 16 2009 11:28PM
Credit:	Marsu Pilami of VeriSign iDefense Labs
Vulnerable:	Nortel Networks Self-Service WVADS 0 Nortel Networks Self-Service Speech Server 0 Nortel Networks Self-Service Peri Workstation 0 Nortel Networks Self-Service Peri Application 0 Nortel Networks Self-Service MPS 500 0 Nortel Networks Self-Service MPS 1000 0 Nortel Networks Self-Service MPS 100 0 Nortel Networks Self-Service Media Processing Server 0 Nortel Networks Self-Service CCXML 0 Nortel Networks Self-Service - CCSS7 0 Nortel Networks Self Service VoiceXML 0 Nortel Networks Multimedia Comm Mas 0 Nortel Networks Media Processing Svr 500 Rel 3.0 Nortel Networks Media Processing Svr 1000 Rel 3.0 Nortel Networks Contact Center NCC 0 Nortel Networks Contact Center Express Nortel Networks Contact Center Administration CCMA 7.0 Nortel Networks Contact Center Administration CCMA 6.0 Nortel Networks Contact Center - TAPI Server 0 Nortel Networks Contact Center - Symposium Agent 0 Nortel Networks CallPilot 703t Nortel Networks CallPilot 702t Nortel Networks CallPilot 702t Nortel Networks CallPilot 201i Nortel Networks CallPilot 200i Nortel Networks CallPilot 1002rp Nortel Networks CallPilot 1002rp Microsoft Office XP SP3 + Microsoft Excel 2002 SP3 + Microsoft Excel 2002 SP3 + Microsoft FrontPage 2002 SP3 + Microsoft FrontPage 2002 SP3 + Microsoft Outlook 2002 SP3 + Microsoft Outlook 2002 SP3 + Microsoft PowerPoint 2002 SP3 + Microsoft PowerPoint 2002 SP3 + Microsoft Publisher 2002 SP3 + Microsoft Publisher 2002 SP3 Microsoft Office XP SP2 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Microsoft Office XP SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Office XP - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional

Not Vulnerable:

Discussion

Microsoft GDI+ Malformed Office Object Memory Corruption Remote Code Execution Vulnerability

Microsoft GDI+ is prone to a remote code-execution vulnerability because the vector graphics link library improperly processes Microsoft Office objects.

An attacker could exploit this issue to execute arbitrary code with the privileges of the currently logged-in user. Failed exploit attempts may crash applications that use the library.

Exploit / POC

Microsoft GDI+ Malformed Office Object Memory Corruption Remote Code Execution Vulnerability

A working commercial exploit is available through VUPEN Security - Exploit and PoCs Service. This exploit is not otherwise publicly available or known to be circulating in the wild.

Solution / Fix

Microsoft GDI+ Malformed Office Object Memory Corruption Remote Code Execution Vulnerability

Solution:
The vendor has released updates and an advisory. Please see the references for details.

Microsoft Office XP SP3

Microsoft Security Update for Microsoft Office XP (KB974811)
http://www.microsoft.com/downloads/details.aspx?familyid=b4ac7fbe-dd19 -4940-a576-89a6b7ed602d&displaylang=en

Microsoft Office XP SP2

Microsoft Security Update for Microsoft Office XP (KB974811)
http://www.microsoft.com/downloads/details.aspx?familyid=b4ac7fbe-dd19 -4940-a576-89a6b7ed602d&displaylang=en

Microsoft Office XP SP1

Microsoft Security Update for Microsoft Office XP (KB974811)
http://www.microsoft.com/downloads/details.aspx?familyid=b4ac7fbe-dd19 -4940-a576-89a6b7ed602d&displaylang=en

Microsoft Office XP

Microsoft Security Update for Microsoft Office XP (KB974811)
http://www.microsoft.com/downloads/details.aspx?familyid=b4ac7fbe-dd19 -4940-a576-89a6b7ed602d&displaylang=en

References

Microsoft GDI+ Malformed Office Object Memory Corruption Remote Code Execution Vulnerability

References:

Microsoft Homepage (Microsoft)
Microsoft Office Drawing Format Shape Properties Memory Corruption Vulnerability (iDefense Labs)
iDefense Security Advisory 10.13.09: Microsoft Office Drawing Format Shape Prope (iDefense Labs )
Microsoft Security Bulletin MS09-062 (Microsoft)
New attack surface reduction feature in GDI+ (Microsoft Security Research & Defense)
Nortel Enterprise Response to Microsoft Security Bulletin MS09-062 (Nortel Networks)