BID:36651

Microsoft GDI+ Malformed Office BMP File Integer Overflow Remote Code Execution Vulnerability

Info

Microsoft GDI+ Malformed Office BMP File Integer Overflow Remote Code Execution Vulnerability

Bugtraq ID:	36651
Class:	Boundary Condition Error
CVE:	CVE-2009-2518
Remote:	Yes
Local:	No
Published:	Oct 13 2009 12:00AM
Updated:	Oct 16 2009 11:28PM
Credit:	Carsten H. Eiram of Secunia
Vulnerable:	Nortel Networks Self-Service WVADS 0 Nortel Networks Self-Service Speech Server 0 Nortel Networks Self-Service Peri Workstation 0 Nortel Networks Self-Service Peri Application 0 Nortel Networks Self-Service MPS 500 0 Nortel Networks Self-Service MPS 1000 0 Nortel Networks Self-Service MPS 100 0 Nortel Networks Self-Service Media Processing Server 0 Nortel Networks Self-Service CCXML 0 Nortel Networks Self-Service - CCSS7 0 Nortel Networks Self Service VoiceXML 0 Nortel Networks Multimedia Comm Mas 0 Nortel Networks Media Processing Svr 500 Rel 3.0 Nortel Networks Media Processing Svr 1000 Rel 3.0 Nortel Networks Contact Center NCC 0 Nortel Networks Contact Center Express Nortel Networks Contact Center Administration CCMA 7.0 Nortel Networks Contact Center Administration CCMA 6.0 Nortel Networks Contact Center - TAPI Server 0 Nortel Networks Contact Center - Symposium Agent 0 Nortel Networks CallPilot 703t Nortel Networks CallPilot 702t Nortel Networks CallPilot 702t Nortel Networks CallPilot 201i Nortel Networks CallPilot 200i Nortel Networks CallPilot 1002rp Nortel Networks CallPilot 1002rp Microsoft Office XP SP3 + Microsoft Excel 2002 SP3 + Microsoft Excel 2002 SP3 + Microsoft FrontPage 2002 SP3 + Microsoft FrontPage 2002 SP3 + Microsoft Outlook 2002 SP3 + Microsoft Outlook 2002 SP3 + Microsoft PowerPoint 2002 SP3 + Microsoft PowerPoint 2002 SP3 + Microsoft Publisher 2002 SP3 + Microsoft Publisher 2002 SP3 Microsoft Office XP SP2 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Microsoft Office XP SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Office XP - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional

Not Vulnerable:

Discussion

Microsoft GDI+ Malformed Office BMP File Integer Overflow Remote Code Execution Vulnerability

Microsoft GDI+ is prone to a remote code-execution vulnerability because the vector graphics link library improperly processes BMP files in Microsoft Office documents.

An attacker could exploit this issue to execute arbitrary code with the privileges of the currently logged-in user. Failed exploit attempts may crash applications that use the library.

Exploit / POC

Microsoft GDI+ Malformed Office BMP File Integer Overflow Remote Code Execution Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Solution / Fix

Microsoft GDI+ Malformed Office BMP File Integer Overflow Remote Code Execution Vulnerability

Solution:
The vendor has released updates and an advisory. Please see the references for details.

Microsoft Office XP SP3

Microsoft Security Update for Microsoft Office XP (KB974811)
http://www.microsoft.com/downloads/details.aspx?familyid=b4ac7fbe-dd19 -4940-a576-89a6b7ed602d&displaylang=en

Microsoft Office XP SP2

Microsoft Security Update for Microsoft Office XP (KB974811)
http://www.microsoft.com/downloads/details.aspx?familyid=b4ac7fbe-dd19 -4940-a576-89a6b7ed602d&displaylang=en

Microsoft Office XP SP1

Microsoft Security Update for Microsoft Office XP (KB974811)
http://www.microsoft.com/downloads/details.aspx?familyid=b4ac7fbe-dd19 -4940-a576-89a6b7ed602d&displaylang=en

Microsoft Office XP

Microsoft Security Update for Microsoft Office XP (KB974811)
http://www.microsoft.com/downloads/details.aspx?familyid=b4ac7fbe-dd19 -4940-a576-89a6b7ed602d&displaylang=en

References

Microsoft GDI+ Malformed Office BMP File Integer Overflow Remote Code Execution Vulnerability

References:

Secunia Research: Microsoft Office BMP Image Colour Handling Integer Overfl (Secunia Research)
Microsoft Homepage (Microsoft)
Secunia Research: Microsoft Office BMP Image Colour Handling Integer Overflow (Secunia Research )
Microsoft Security Bulletin MS09-062 (Microsoft)
New attack surface reduction feature in GDI+ (Microsoft Security Research & Defense)
Nortel Enterprise Response to Microsoft Security Bulletin MS09-062 (Nortel Networks)