Microsoft Windows '.ani' File 'tagBITMAPINFOHEADER' Denial of Service Vulnerability

Bugtraq ID:	38579
Class:	Boundary Condition Error
CVE:	CVE-2010-1098
Remote:	Yes
Local:	No
Published:	Mar 08 2010 12:00AM
Updated:	Apr 13 2015 09:02PM
Credit:	SkyLined
Vulnerable:	Microsoft Windows XP 0 Microsoft Windows Vista 0
Not Vulnerable:

Microsoft Windows '.ani' File 'tagBITMAPINFOHEADER' Denial of Service Vulnerability

Microsoft Windows is prone to a remote denial-of-service vulnerability when processing '.ani' files.

Successful exploits will cause the vulnerable applications that use the affected APIs to crash or become unresponsive, denying service to legitimate users.

Microsoft Windows '.ani' File 'tagBITMAPINFOHEADER' Denial of Service Vulnerability

The following exploit code is available:

• /data/vulnerabilities/exploits/38579.py

Microsoft Windows '.ani' File 'tagBITMAPINFOHEADER' Denial of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of any more recent information, please mail us at: [email protected].

Microsoft Windows '.ani' File 'tagBITMAPINFOHEADER' Denial of Service Vulnerability

References:

• Issue 3: MSRC 9754jr - Windows .ANI file BITMAPINFOHEADER.biClrUsed bounds c (SkyLined)
  
• Microsoft Windows .ANI file BITMAPINFOHEADER.biClrUsed bounds check missing (Microsoft)
  
• Microsoft Windows Homepage (Microsoft)