[security-alerts] FW: [SA21377] Microsoft Windows WMF File Handling Denial of Service

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> 
> TITLE:
> Microsoft Windows WMF File Handling Denial of Service
> 
> SECUNIA ADVISORY ID:
> SA21377
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/21377/
> 
> CRITICAL:
> Not critical
> 
> IMPACT:
> DoS
> 
> WHERE:
> From remote
> 
> OPERATING SYSTEM:
> Microsoft Windows XP Professional
> http://secunia.com/product/22/
> Microsoft Windows XP Home Edition
> http://secunia.com/product/16/
> Microsoft Windows Server 2003 Web Edition
> http://secunia.com/product/1176/
> Microsoft Windows Server 2003 Standard Edition
> http://secunia.com/product/1173/
> Microsoft Windows Server 2003 Enterprise Edition
> http://secunia.com/product/1174/
> Microsoft Windows Server 2003 Datacenter Edition
> http://secunia.com/product/1175/
> Microsoft Windows 2000 Server
> http://secunia.com/product/20/
> Microsoft Windows 2000 Professional
> http://secunia.com/product/1/
> Microsoft Windows 2000 Datacenter Server
> http://secunia.com/product/1177/
> Microsoft Windows 2000 Advanced Server
> http://secunia.com/product/21/
> 
> DESCRIPTION:
> cyanid-E has discovered a vulnerability in Microsoft Windows, which
> can be exploited by malicious people to cause a DoS (Denial of
> Service).
> 
> The vulnerability is caused due to a signedness error in the GDI
> Client DLL library (gdi32.dll) when processing WMF files. This can be
> exploited to crash an application using the vulnerable library (e.g.
> explorer.exe) by tricking a user into viewing a specially crafted WMF
> file.
> 
> The vulnerability has been confirmed on a fully patched Windows XP
> SP2. Other versions may also be affected.
> 
> SOLUTION:
> Grant only trusted users access to affected systems. Open trusted WMF
> files only.
> 
> PROVIDED AND/OR DISCOVERED BY:
> cyanid-E
> 
> ORIGINAL ADVISORY:
> cyanid-E:
> http://lists.grok.org.uk/pipermail/full-disclosure/2006-August
> /048530.html
> http://lists.grok.org.uk/pipermail/full-disclosure/2006-August
> /048547.html
> 
>