Microsoft Windows GDI32.DLL WMF image rendering code execution
|win-wmf-execute-code (23846)||High Risk|
Multiple applications that use the GDI32.DLL (Graphics Rendering Engine) to parse and display Windows Meta File (WMF) images could allow a remote attacker to execute arbitrary code on the system, caused by a vulnerability in the SETABORTPROC function. The Windows Picture and Fax viewer is the default application to handle files with the .wmf extension. By creating a malicious WMF image and hosting it on a Web site or sending it to a potential victim as an email attachment, a remote attacker could execute arbitrary code to gain complete control of a victim's system, if the attacker could persuade the victim to visit the malicious Web site or open the email attachment.
Note: It is reported that this vulnerability affects the Graphics Rendering Engine used by other vendors, including Mozilla Firefox and Wine.
As a workaround, do not open or preview .wmf files that are not trusted.
For vulnerability detection:
Enable the following checks in the ISS Protection platform:
Enable the following checks in the Dynamic ISS Protection platform:
For Manual Protection:
Apply the appropriate patch for your system, as listed in the latest Microsoft Security Bulletin. See References.
— OR —
Use Microsoft Automatic Update if it is supported by your operating system. The original bulletin issued by Microsoft has been superseded.
For Debian GNU/Linux:
Refer to DSA-954-1 for patch, upgrade, or suggested workaround information. See References.
Other vendor remedy information:
Upgrade to the latest versions of Wine (1.12 or later) available from the Wine Web site. See References.
For Gentoo Linux (Wine):
Refer to Gentoo Linux Security Announcement GLSA 2006-01-09 for patch, upgrade, or suggested workaround information. See References.
- F-Secure : News from the Lab Wednesday, December 28, 2005: New WMF 0-day exploit.
- IBM Internet Security Systems X-Force Database: Microsoft Windows Metafile image format buffer overflow.
- Internet Security Systems Protection Alert: Additional Vectors for GDI32.DLL WMF Image Rendering Vulnerability.
- Internet Security Systems Protection Alert December 28, 2005: Microsoft Picture and Fax Viewer WMF Buffer Overflow.
- Microsoft Security Advisory (912840): Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution..
- Microsoft Security Bulletin MS06-001: Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution (912919).
- Microsoft Security Bulletin MS07-046: Vulnerability in GDI Could Allow Remote Code Execution (938829).
- Microsoft Security Bulletin MS08-021: Vulnerabilities in GDI Could Allow Remote Code Execution (948590).
- Microsoft.com Web site: Windows Picture and Fax Viewer overview.
- US-CERT Technical Cyber Security Alert TA05-362A: Microsoft Windows Metafile Handling Buffer Overflow.
- ASA-2006-001: WMF vulnerability in Windows (MS06-001)
- BID-16074: Microsoft Windows Graphics Rendering Engine WMF SetAbortProc Code Execution Vulnerability
- CVE-2005-4560: The Windows Graphical Device Interface library (GDI32.DLL) in Microsoft Windows allows remote attackers to execute arbitrary code via a Windows Metafile (WMF) format image with a crafted SETABORTPROC GDI Escape function call, related to the Windows Picture and Fax Viewer (SHIMGVW.DLL), a different vulnerability than CVE-2005-2123 and CVE-2005-2124, and as originally discovered in the wild on unionseek.com.
- CVE-2006-0106: gdi/driver.c and gdi/printdrv.c in Wine 20050930, and other versions, implement the SETABORTPROC GDI Escape function call for Windows Metafile (WMF) files, which allows attackers to execute arbitrary code, the same vulnerability as CVE-2005-4560 but in a different codebase.
- DSA-954: wine -- design flaw
- GLSA-200601-09: Wine: Windows Metafile SETABORTPROC vulnerability
- MDKSA-2006:014: Updated wine packages fix WMF vulnerability
- SA18255: Microsoft Windows WMF "SETABORTPROC" Arbitrary Code Execution
- SA18311: Nortel Centrex IP Client Manager Multiple Vulnerabilities
- SA18323: Wine Potential WMF "SETABORTPROC" Vulnerability
- SA18364: Avaya Products Microsoft Windows WMF "SETABORTPROC" Vulnerability
- SA18415: Nortel Products Microsoft Windows WMF "SETABORTPROC" Code Execution
- SECTRACK ID: 1015416: Microsoft Windows Unspecified WMF Rendering Bug Lets Remote Users Execute Arbitrary Code
- SUSE-SR:2006:002: SUSE Security Summary Report
- US-CERT VU#181038: Microsoft Windows Metafile handler SETABORTPROC GDI Escape vulnerability
- Debian Debian Linux 3.1
- Gentoo Linux
- MandrakeSoft Mandrake Linux 2006
- MandrakeSoft Mandrake Linux Corporate Server 3.0
- Microsoft Windows 2000 SP4
- Microsoft Windows 2003 Server x64
- Microsoft Windows 2003 Server Itanium
- Microsoft Windows 2003 Server SP1 Itanium
- Microsoft Windows 2003 Server SP1
- Microsoft Windows XP SP1
- Microsoft Windows XP x64 Professional
- Microsoft Windows XP SP2
- Wine Wine prior to 1.12
Dec 27, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email ignore thisxforceignore this@ignore thisus.ignore thisibm.comignore this
* According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall IBM be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.