Microsoft Windows GDI32.DLL WMF image rendering code execution
| win-wmf-execute-code (23846) |  High Risk |
Description:
Multiple applications that use the GDI32.DLL (Graphics Rendering Engine) to parse and display Windows Meta File (WMF) images could allow a remote attacker to execute arbitrary code on the system, caused by a vulnerability in the SETABORTPROC function. The Windows Picture and Fax viewer is the default application to handle files with the .wmf extension. By creating a malicious WMF image and hosting it on a Web site or sending it to a potential victim as an email attachment, a remote attacker could execute arbitrary code to gain complete control of a victim's system, if the attacker could persuade the victim to visit the malicious Web site or open the email attachment.
Note: It is reported that this vulnerability affects the Graphics Rendering Engine used by other vendors, including Mozilla Firefox and Wine.
Platforms Affected:
- Debian, Debian Linux 3.1
- Gentoo, Linux
- MandrakeSoft, Mandrake Linux 2006
- MandrakeSoft, Mandrake Linux Corporate Server 3.0
- Microsoft, Windows 2000 SP4
- Microsoft, Windows 2003 Server x64
- Microsoft, Windows 2003 Server Itanium
- Microsoft, Windows 2003 Server SP1 Itanium
- Microsoft, Windows 2003 Server SP1
- Microsoft, Windows XP SP1
- Microsoft, Windows XP Professional x64
- Microsoft, Windows XP SP2
- Wine, Wine prior to 1.12
Remedy:
As a workaround, do not open or preview .wmf files that are not trusted.
For vulnerability detection:
Enable the following checks in the ISS Protection platform:
WinMs06kb912919Update
Enable the following checks in the Dynamic ISS Protection platform:
Image_WMF_Generic_RecordSize_Overflow
Image_WMF_Code_Exec_Function
For Manual Protection:
Apply the appropriate patch for your system, as listed in the latest Microsoft Security Bulletin. See References.
— OR —
Use Microsoft Automatic Update if it is supported by your operating system. The original bulletin issued by Microsoft has been superseded.
For Debian GNU/Linux:
Refer to DSA-954-1 for patch, upgrade, or suggested workaround information. See References.
Other vendor remedy information:
For Wine:
Upgrade to the latest versions of Wine (1.12 or later) available from the Wine Web site. See References.
For Gentoo Linux (Wine):
Refer to Gentoo Linux Security Announcement GLSA 2006-01-09 for patch, upgrade, or suggested workaround information. See References.
Consequences:
Gain Access
References:
- F-Secure : News from the Lab Wednesday, December 28, 2005, New WMF 0-day exploit at http://www.f-secure.com/weblog/#00000752.
- IBM Internet Security Systems X-Force Database, Microsoft Windows Metafile image format buffer overflow at http://xforce.iss.net/xforce/xfdb/22877.
- Internet Security Systems Protection Alert, Additional Vectors for GDI32.DLL WMF Image Rendering Vulnerability at http://xforce.iss.net/xforce/alerts/id/212.
- Internet Security Systems Protection Alert December 28, 2005, Microsoft Picture and Fax Viewer WMF Buffer Overflow at http://xforce.iss.net/xforce/alerts/id/211.
- Microsoft Security Advisory (912840), Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution. at http://www.microsoft.com/technet/security/advisory/912840.mspx.
- Microsoft Security Bulletin MS06-001, Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution (912919) at http://www.microsoft.com/technet/security/Bulletin/MS06-001.mspx.
- Microsoft Security Bulletin MS07-046, Vulnerability in GDI Could Allow Remote Code Execution (938829) at http://www.microsoft.com/technet/security/bulletin/ms07-046.mspx.
- Microsoft Security Bulletin MS08-021, Vulnerabilities in GDI Could Allow Remote Code Execution (948590) at http://www.microsoft.com/technet/security/bulletin/ms08-021.mspx.
- Microsoft.com Web site, Windows Picture and Fax Viewer overview at http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/image_overview.mspx.
- US-CERT Technical Cyber Security Alert TA05-362A, Microsoft Windows Metafile Handling Buffer Overflow at http://www.us-cert.gov/cas/techalerts/TA05-362A.html.
- ASA-2006-001: WMF vulnerability in Windows (MS06-001)
- BID-16074: Microsoft Windows Graphics Rendering Engine WMF SetAbortProc Code Execution Vulnerability
- CVE-2005-4560: The Windows Graphical Device Interface library (GDI32.DLL) in Microsoft Windows allows remote attackers to execute arbitrary code via a Windows Metafile (WMF) format image with a crafted SETABORTPROC GDI Escape function call, related to the Windows Picture and Fax Viewer (SHIMGVW.DLL), a different vulnerability than CVE-2005-2123 and CVE-2005-2124, and as originally discovered in the wild on unionseek.com.
- CVE-2006-0106: gdi/driver.c and gdi/printdrv.c in Wine 20050930, and other versions, implement the SETABORTPROC GDI Escape function call for Windows Metafile (WMF) files, which allows attackers to execute arbitrary code, the same vulnerability as CVE-2005-4560 but in a different codebase.
- DSA-954: wine -- design flaw
- GLSA-200601-09: Wine: Windows Metafile SETABORTPROC vulnerability
- MDKSA-2006:014: Updated wine packages fix WMF vulnerability
- SA18255: Microsoft Windows WMF "SETABORTPROC" Arbitrary Code Execution
- SA18311: Nortel Centrex IP Client Manager Multiple Vulnerabilities
- SA18323: Wine Potential WMF "SETABORTPROC" Vulnerability
- SA18364: Avaya Products Microsoft Windows WMF "SETABORTPROC" Vulnerability
- SA18415: Nortel Products Microsoft Windows WMF "SETABORTPROC" Code Execution
- SECTRACK ID: 1015416: Microsoft Windows Unspecified WMF Rendering Bug Lets Remote Users Execute Arbitrary Code
- SUSE-SR:2006:002: SUSE Security Summary Report
- US-CERT VU#181038: Microsoft Windows Metafile handler SETABORTPROC GDI Escape vulnerability
- VUPEN/ADV-2005-3086: Microsoft Windows WMF Handling Remote Code Execution Vulnerability
- VUPEN/ADV-2006-0098: Wine Windows Metafile SetAbortProc Code Execution Vulnerability
Reported:
Dec 27, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net