ðòïåëôù 


  áòèé÷ 


Apache-Talk @lexa.ru 

Inet-Admins @info.east.ru 

Filmscanners @halftone.co.uk 

Security-alerts @yandex-team.ru 

nginx-ru @sysoev.ru 

  óôáôøé 


  ðåòóïîáìøîïå 


  ðòïçòáííù 



ðéûéôå
ðéóøíá














     áòèé÷ :: Security-alerts
Security-Alerts mailing list archive (security-alerts@yandex-team.ru)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[security-alerts] FW: WMF CreateBrushIndirect vulnerability (DoS)



> -----Original Message-----
> From: Alexander Sotirov [mailto:asotirov@xxxxxxxxxxxxx] 
> Sent: Thursday, January 11, 2007 6:23 AM
> To: bugtraq@xxxxxxxxxxxxxxxxx
> Subject: WMF CreateBrushIndirect vulnerability (DoS)
> 
> The following WMF exploit appeared on milw0rm today:
> http://www.milw0rm.com/exploits/3111
> 
> The vulnerability is a result of the WMF parser passing a 
> value from the file as
> a pointer argument to the CreateBrushIndirect function. The function
> dereferences the pointer and dies with an access violation.
> 
> The value in the file is only 16-bit and it is sign extended 
> into a 32-bit
> pointer. This means that we can only access addresses from 
> 0x00000000 to
> 0x0000FFFF and from 0xFFFF0000 to 0xFFFFFFFF. Both of these 
> ranges are always
> invalid, so the vulnerability is just a DoS.
> 
> For more details and some commentary, see:
> http://determina.blogspot.com/2007/01/whats-wrong-with-wmf.html
> 
> 
> Alexander Sotirov
> Determina Security Research
> 
> 



 




Copyright © Lexa Software, 1996-2009.