exploit the possibilities

iDEFENSE Security Advisory 2007-07-18.1

iDEFENSE Security Advisory 2007-07-18.1
Posted Jul 19, 2007
Authored by iDefense Labs, Ruben Santamarta | Site idefense.com

iDefense Security Advisory 07.18.07 - Exploitation of an input validation vulnerability in Microsoft Corp.'s DirectX library could allow an attacker to execute arbitrary code in the context of the current user. The vulnerability specifically exists in the way RLE compressed Targa format image files are opened. The Targa format allows multiple color depths and image storage options, depths and image storage options, and includes the ability to use run-length encoding (RLE), compression on the image data. This is a compression method which finds a 'run' of the pixels the same color and instead of storing the value multiple times, encodes the number of times to repeat one value. For example, instead of storing 'AAAAAAAA', it may encode that into 'store "A" 8 times'. The buffer allocated for the image data is based on the width, height and color depth stored in the image, but when decoding this type of file, no checks against writing past the end of the buffer are performed. If the encoding specifies more data than has been allocated, a controlled heap overflow can occur. iDefense has confirmed that libraries in Microsoft's DirectX SDK (February 2006) are vulnerable, as are the DirectX End User Runtimes (February 2006). It is suspected that previous versions are also affected, including the DirectX 9.0c End User Runtimes.

tags | advisory, overflow, arbitrary
advisories | CVE-2006-4183
MD5 | 90bae1472730b5cdfd52dc955a5da8ea

iDEFENSE Security Advisory 2007-07-18.1

Change Mirror Download
Microsoft DirectX RLE Compressed Targa Image File Heap Overflow

iDefense Security Advisory 07.18.07
http://labs.idefense.com/intelligence/vulnerabilities/
Jul 18, 2007

I. BACKGROUND

Microsoft DirectX is a collection of APIs for easily handling tasks
related to game programming on the Microsoft Windows operating system.
More information on DirectX is available by following the link shown
below.

http://msdn.microsoft.com/directx/

II. DESCRIPTION

Exploitation of an input validation vulnerability in Microsoft Corp.'s
DirectX library could allow an attacker to execute arbitrary code in
the context of the current user.

The vulnerability specifically exists in the way RLE compressed Targa
format image files are opened. The Targa format allows multiple color
depths and image storage options, depths and image storage options, and
includes the ability to use run-length encoding (RLE), compression on
the image data. This is a compression method which finds a 'run' of the
pixels the same color and instead of storing the value multiple times,
encodes the number of times to repeat one value. For example, instead
of storing 'AAAAAAAA', it may encode that into 'store "A" 8 times'. The
buffer allocated for the image data is based on the width, height and
color depth stored in the image, but when decoding this type of file,
no checks against writing past the end of the buffer are performed. If
the encoding specifies more data than has been allocated, a controlled
heap overflow can occur.

III. ANALYSIS

Exploitation could allow a remote attacker to execute arbitrary code in
the context of the affected application.

If the DirectX SDK is installed on a system, this function is used to
display a preview in Windows Explorer's 'Details' pane, causing
Explorer to become vulnerable.

The DirectX End User Runtimes are often bundled with games or
applications. Vectors potentially affecting users with either the SDK
or the End User Runtime include online games and applications where
graphics files are be downloaded from a remote server and used as a
texture.

IV. DETECTION

iDefense has confirmed that libraries in Microsoft's DirectX SDK
(February 2006) are vulnerable, as are the DirectX End User Runtimes
(February 2006). It is suspected that previous versions are also
affected, including the DirectX 9.0c End User Runtimes.

V. WORKAROUND

iDefense is currently unaware of any effective workarounds for this
vulnerability.

VI. VENDOR RESPONSE

Microsoft reports that they addressed this vulnerability in the October
2006 SDK and End-User Runtime releases. iDefense has confirmed that
this vulnerability no longer exists in the June 2007 release.

VII. CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2006-4183 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org/), which standardizes names for
security problems.

VIII. DISCLOSURE TIMELINE

08/16/2006 Initial vendor notification
10/05/2006 Initial vendor response
10/05/2006 Second vendor notification
07/18/2007 Public disclosure

IX. CREDIT

This vulnerability was reported to iDefense by Rubén Santamarta of
www.reversemode.com.

Get paid for vulnerability research
http://labs.idefense.com/methodology/vulnerability/vcp.php

Free tools, research and upcoming events
http://labs.idefense.com/

X. LEGAL NOTICES

Copyright © 2007 iDefense, Inc.

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDefense. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically,
please e-mail customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct,
indirect, or consequential loss or damage arising from use of, or
reliance on, this information.

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

March 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    2 Files
  • 2
    Mar 2nd
    18 Files
  • 3
    Mar 3rd
    15 Files
  • 4
    Mar 4th
    12 Files
  • 5
    Mar 5th
    19 Files
  • 6
    Mar 6th
    8 Files
  • 7
    Mar 7th
    1 Files
  • 8
    Mar 8th
    1 Files
  • 9
    Mar 9th
    11 Files
  • 10
    Mar 10th
    15 Files
  • 11
    Mar 11th
    9 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    13 Files
  • 14
    Mar 14th
    10 Files
  • 15
    Mar 15th
    13 Files
  • 16
    Mar 16th
    27 Files
  • 17
    Mar 17th
    15 Files
  • 18
    Mar 18th
    23 Files
  • 19
    Mar 19th
    25 Files
  • 20
    Mar 20th
    10 Files
  • 21
    Mar 21st
    6 Files
  • 22
    Mar 22nd
    1 Files
  • 23
    Mar 23rd
    22 Files
  • 24
    Mar 24th
    15 Files
  • 25
    Mar 25th
    22 Files
  • 26
    Mar 26th
    20 Files
  • 27
    Mar 27th
    15 Files
  • 28
    Mar 28th
    10 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close