[security-alerts] FW: [SA26423] Windows Graphics Rendering Engine Image Handling Vulnerability

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

>
> TITLE:
> Windows Graphics Rendering Engine Image Handling Vulnerability
>
> SECUNIA ADVISORY ID:
> SA26423
>
> VERIFY ADVISORY:
> http://secunia.com/advisories/26423/
>
> CRITICAL:
> Highly critical
>
> IMPACT:
> DoS, System access
>
> WHERE:
> From remote
>
> OPERATING SYSTEM:
> Microsoft Windows 2000 Advanced Server
> http://secunia.com/product/21/
> Microsoft Windows 2000 Datacenter Server
> http://secunia.com/product/1177/
> Microsoft Windows 2000 Professional
> http://secunia.com/product/1/
> Microsoft Windows 2000 Server
> http://secunia.com/product/20/
> Microsoft Windows XP Home Edition
> http://secunia.com/product/16/
> Microsoft Windows XP Professional
> http://secunia.com/product/22/
> Microsoft Windows Server 2003 Datacenter Edition
> http://secunia.com/product/1175/
> Microsoft Windows Server 2003 Enterprise Edition
> http://secunia.com/product/1174/
> Microsoft Windows Server 2003 Standard Edition
> http://secunia.com/product/1173/
> Microsoft Windows Server 2003 Web Edition
> http://secunia.com/product/1176/
> Microsoft Windows Storage Server 2003
> http://secunia.com/product/12399/
>
> DESCRIPTION:
> A vulnerability has been reported in Microsoft Windows, which
> potentially can be exploited by malicious people to compromise a
> user's system.
>
> The vulnerability is caused due to a boundary error in the graphics
> rendering engine when parsing images.
>
> Successful exploitation may allow execution of arbitrary code if a
> user e.g. opens a specially crafted attachment in an e-mail.
>
> SOLUTION:
> Apply patches.
>
> Windows 2000 SP4:
> http://www.microsoft.com/downloads/details.aspx?FamilyId=8fc83
> 40b-c2b3-4559-835c-caa00cf086b9
>
> Windows XP SP2:
> http://www.microsoft.com/downloads/details.aspx?FamilyId=dc294
> 75d-c0bb-4d35-8dd6-4ca1cac32315
>
> Windows XP Professional x64 Edition:
> http://www.microsoft.com/downloads/details.aspx?FamilyId=3c817
> 30a-981a-4649-b2d9-45144230d512
>
> Windows Server 2003 SP1:
> http://www.microsoft.com/downloads/details.aspx?FamilyId=53745
> 83d-de68-4d65-bca8-598d6b98b8b3
>
> Windows Server 2003 x64 Edition:
> http://www.microsoft.com/downloads/details.aspx?FamilyId=c3359
> f27-e03e-4a4f-b896-3bda39f69f7e
>
> Windows Server 2003 with SP1 for Itanium-based systems:
> http://www.microsoft.com/downloads/details.aspx?FamilyId=92822
> 479-2060-4357-a340-ed096f180b2b
>
> PROVIDED AND/OR DISCOVERED BY:
> The vendor credits eEye Digital Security.
>
> ORIGINAL ADVISORY:
> MS07-046 (KB938829):
> http://www.microsoft.com/technet/security/Bulletin/MS07-046.mspx
>
>