Public Vulnerability Reports

Microsoft Windows GDI+ Gradient Fill Heap Overflow Vulnerability

09.09.08

BACKGROUND

The GDI+ library, or "GdiPlus.dll", provides access to a number of graphics methods, via a class-based API. Vector Markup Language (VML) is a component of the Extensible Markup Language (XML) that specifies vector images (e.g., rectangles and ovals) using the GDI+ API. For more information about these technologies, visit the following URLs.

http://msdn.microsoft.com/en-us/library/ms533797(VS.85).aspx
http://msdn.microsoft.com/en-us/library/ms533798(VS.85).aspx
http://www.w3.org/TR/1998/NOTE-VML-19980513
http://en.wikipedia.org/wiki/Vector_Markup_Language

DESCRIPTION

Remote exploitation of an integer overflow vulnerability in multiple versions of Microsoft Corp.'s GDI+ could allow an attacker to execute arbitrary code within the context of the local user.

The vulnerability specifically exists in the memory allocation performed by the GDI+ library. Certain malformed gradient fill input can cause the application to corrupt the heap, potentially allowing arbitrary code execution.

ANALYSIS

Exploitation of this vulnerability may allow an attacker to execute arbitrary code in the context of the current user. To exploit this vulnerability, the attacker would need to convince a targeted user to render a document with an application that utilizes the vulnerable GDI+ functions. This could be accomplished by persuading the user to follow a link, view a document, or read an e-mail message.

DETECTION

iDefense Labs confirmed this vulnerability affects Internet Explorer 7 and Internet Explorer 6 on the Microsoft Windows XP SP2 platform. The following versions of VGX.DLL were tested and found to be vulnerable:

 7.00.6000.20628 7.00.6000.16386 6.00.2900.3051 6.00.2900.2997 

While the VGX.DLL library (which handles VML) appears to be the most likely vector, Microsoft have indicated to us that the GdiPlus.dll is the root cause of the vulnerability. Version 5.1.3102.2180 of GdiPlus.dll was installed on each of the tested systems.

WORKAROUND

In order to prevent exploitation of this vulnerability, unregister or deny access to vgx.dll and/or gdiplus.dll. Note that doing so will prevent proper rendering of documents that rely on the affected component.

VENDOR RESPONSE

Microsoft has officially addressed this vulnerability with Security Bulletin MS08-052. For more information, consult their bulletin at the following URL.

http://www.microsoft.com/technet/security/bulletin/ms08-052.mspx

CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2007-5348 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org/), which standardizes names for security problems.

DISCLOSURE TIMELINE

05/09/2007 Initial vendor notification
05/09/2007 Initial vendor response
09/09/2008 Coordinated public disclosure

CREDIT

This vulnerability was discovered by Greg MacManus during his tenure with iDefense Labs.

Get paid for vulnerability research
http://labs.idefense.com/methodology/vulnerability/vcp.php

Free tools, research and upcoming events
http://labs.idefense.com/

LEGAL NOTICES

Copyright © 2008 Verisign, Inc.

Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDefense. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please e-mail customer service for permission.

Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.