----------------------------------------------------------------------

We have updated our website, enjoy!
http://secunia.com/

----------------------------------------------------------------------

TITLE:
Microsoft Products GDI+ Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA31675

VERIFY ADVISORY:
http://secunia.com/advisories/31675/

CRITICAL:
Highly critical

IMPACT:
System access

WHERE:
>From remote

OPERATING SYSTEM:
Microsoft Windows XP Professional
http://secunia.com/product/22/
Microsoft Windows XP Home Edition
http://secunia.com/product/16/
Microsoft Windows Vista
http://secunia.com/product/13223/
Microsoft Windows Storage Server 2003
http://secunia.com/product/12399/
Microsoft Windows Server 2008
http://secunia.com/product/18255/
Microsoft Windows Server 2003 Web Edition
http://secunia.com/product/1176/
Microsoft Windows Server 2003 Standard Edition
http://secunia.com/product/1173/
Microsoft Windows Server 2003 Enterprise Edition
http://secunia.com/product/1174/
Microsoft Windows Server 2003 Datacenter Edition
http://secunia.com/product/1175/

SOFTWARE:
SQL Server 2000 Reporting Services
http://secunia.com/product/19776/
Microsoft Works 8.x
http://secunia.com/product/7215/
Microsoft Visual Studio 2008
http://secunia.com/product/17277/
Microsoft Visual Studio 2005
http://secunia.com/product/6779/
Microsoft Visual Studio .NET 2003
http://secunia.com/product/1086/
Microsoft Visual Studio .NET 2002
http://secunia.com/product/1087/
Microsoft Visual FoxPro 9.x
http://secunia.com/product/15503/
Microsoft Visual FoxPro 8.x
http://secunia.com/product/412/
Microsoft Visio 2002
http://secunia.com/product/1091/
Microsoft SQL Server 2005 Express Edition
http://secunia.com/product/6479/
Microsoft SQL Server 2005 Compact Edition 3.x
http://secunia.com/product/15845/
Microsoft SQL Server 2005
http://secunia.com/product/6782/
Microsoft Report Viewer 2005
http://secunia.com/product/14769/
Microsoft Platform SDK Redistributable: GDI+
http://secunia.com/product/19777/
Microsoft Office XP
http://secunia.com/product/23/
Microsoft Office PowerPoint 2003 Viewer
http://secunia.com/product/4033/
Microsoft Office 2007
http://secunia.com/product/13228/
Microsoft Office 2003 Student and Teacher Edition
http://secunia.com/product/2278/
Microsoft Office 2003 Standard Edition
http://secunia.com/product/2275/
Microsoft Office 2003 Small Business Edition
http://secunia.com/product/2277/
Microsoft Office 2003 Professional Edition
http://secunia.com/product/2276/
Microsoft Internet Explorer 6.x
http://secunia.com/product/11/
Microsoft Forefront Client Security 1.x
http://secunia.com/product/17290/
Microsoft Digital Image 2006 11.x
http://secunia.com/product/7791/
Microsoft .NET Framework 2.x
http://secunia.com/product/6456/
Microsoft .NET Framework 1.x
http://secunia.com/product/667/
Microsoft Report Viewer 2008
http://secunia.com/product/19778/

DESCRIPTION:
Multiple vulnerabilities have been reported in various Microsoft
products, which can be exploited by malicious people to compromise a
vulnerable system.

1) An error in the way GDI+ handles gradient sizes can be exploited
to cause a heap-based buffer overflow via a specially crafted file.

2) An error in the way GDI+ processes EMF files can be exploited to
cause memory corruption via a specially crafted EMF image file.

3) An error in the way GDI+ parses records in GIF images can be
exploited via a specially crafted GIF image file.

4) An error in the way GDI+ parses WMF files can be exploited to
cause a buffer overflow via a specially crafted WMF image file.

5) An integer overflow in GDI+ when parsing BMP file headers can be
exploited to cause a buffer overflow via a specially crafted BMP
image file.

Successful exploitation of the vulnerabilities may allow execution of
arbitrary code.

SOLUTION:
Apply patches.

Windows XP SP2/SP3:
http://www.microsoft.com/downloads/details.aspx?familyid=e0bd6fbe-f46e-4961-9a79-49ec77d39439

Windows XP Professional x64 Edition (optionally with SP2):
http://www.microsoft.com/downloads/details.aspx?familyid=c5d26771-1f49-4bbf-902c-bf92e527cadb

Windows Server 2003 SP1/SP2:
http://www.microsoft.com/downloads/details.aspx?familyid=ac03f138-eca4-46e1-9782-e811820e547f

Windows Server 2003 x64 Edition (optionally with SP2):
http://www.microsoft.com/downloads/details.aspx?familyid=93f1451b-5b62-47e5-8f0c-b720b957999a

Windows Server 2003 with SP1/SP2 for Itanium-based Systems:
http://www.microsoft.com/downloads/details.aspx?familyid=14e99f8a-cdd4-40d7-8cfc-73ae6bd6dfad

Windows Vista (optionally with SP1):
http://www.microsoft.com/downloads/details.aspx?familyid=16f3ad21-ed77-4c32-93df-3b650b2b32a5

Windows Vista x64 Edition (optionally with SP1):
http://www.microsoft.com/downloads/details.aspx?familyid=aa47d016-f5c9-4586-8876-f1f4f255f54d

Windows Server 2008 for 32-bit Systems:
http://www.microsoft.com/downloads/details.aspx?familyid=23bd3be5-cc66-46f8-9420-49d65d8afe1d

Windows Server 2008 for x64-based Systems:
http://www.microsoft.com/downloads/details.aspx?familyid=7f1e0f05-6c9d-4ad1-9b19-50ee4fa7bd7e

Windows Server 2008 for Itanium-based Systems:
http://www.microsoft.com/downloads/details.aspx?familyid=5159bdba-3825-4816-a2be-ab035332b9e2

Internet Explorer 6 SP1 (Windows 2000 SP4):
http://www.microsoft.com/downloads/details.aspx?FamilyId=a860d2d9-653d-4ddb-bbff-323d3ccdb866

Microsoft .NET Framework 1.0 SP3 (Windows 2000 SP4):
http://www.microsoft.com/downloads/details.aspx?FamilyId=C7CBCD19-ACC1-4A89-ADFA-99B2F431510D

Microsoft .NET Framework 1.1 SP1 (Windows 2000 SP4):
http://www.microsoft.com/downloads/details.aspx?FamilyId=6013F866-3EA1-4672-B1BF-E516204C3A7A

Microsoft .NET Framework 2.0 (Windows 2000 SP4):
http://www.microsoft.com/downloads/details.aspx?FamilyId=7F1CD013-2C4B-4582-9114-CB840A96124A

Microsoft .NET Framework 2.0 SP1 (Windows 2000 SP4):
http://www.microsoft.com/downloads/details.aspx?FamilyId=215B73A3-46AB-44A8-A0FB-6D37BD1C39B8

Microsoft Office XP SP3:
http://www.microsoft.com/downloads/details.aspx?familyid=ef3de64c-fc17-4500-9da4-a3bba97fda6d

Microsoft Office 2003 SP2:
http://www.microsoft.com/downloads/details.aspx?familyid=e9f8e309-d721-4bab-b485-5eede8d49eb8

Microsoft Office 2003 SP3:
http://www.microsoft.com/downloads/details.aspx?familyid=e9f8e309-d721-4bab-b485-5eede8d49eb8

2007 Microsoft Office System:
http://www.microsoft.com/downloads/details.aspx?familyid=4b656fe8-6253-490c-a81a-e4e8f0bb58d2

2007 Microsoft Office System SP1:
http://www.microsoft.com/downloads/details.aspx?familyid=4b656fe8-6253-490c-a81a-e4e8f0bb58d2

Microsoft Visio 2002 SP2:
http://www.microsoft.com/downloads/details.aspx?familyid=a6d9d3ef-f087-4f61-9ec1-522b7d4b9c48

Microsoft Office PowerPoint Viewer 2003:
http://www.microsoft.com/downloads/details.aspx?familyid=cd503f08-1831-45ff-bdf4-dd918ca40505

Microsoft Works 8:
http://www.microsoft.com/downloads/details.aspx?familyid=EB0D224E-A517-40D9-9FC6-2345FA12A841

Microsoft Digital Image Suite 2006:
http://www.microsoft.com/downloads/details.aspx?familyid=04afd760-8173-4069-9e82-d3bf053d9eae

SQL Server 2000 Reporting Services SP2 (QFE):
http://www.microsoft.com/downloads/details.aspx?familyid=5F9E7F78-7439-414B-A9DC-A779B89427DB

SQL Server 2005 SP2 (GDR):
http://www.microsoft.com/downloads/details.aspx?familyid=4603C722-2468-4ADB-B945-2ED0458B8F47

SQL Server 2005 SP2 (QFE):
http://www.microsoft.com/downloads/details.aspx?familyid=5148B887-F323-4ADB-9721-61E1C0CFD213

SQL Server 2005 x64 Edition SP2 (GDR):
http://www.microsoft.com/downloads/details.aspx?familyid=4603C722-2468-4ADB-B945-2ED0458B8F47

SQL Server 2005 x64 Edition SP2 (QFE):
http://www.microsoft.com/downloads/details.aspx?familyid=5148B887-F323-4ADB-9721-61E1C0CFD213

SQL Server 2005 for Itanium-based Systems SP2 (GDR):
http://www.microsoft.com/downloads/details.aspx?familyid=4603C722-2468-4ADB-B945-2ED0458B8F47

SQL Server 2005 for Itanium-based Systems SP2 (QFE):
http://www.microsoft.com/downloads/details.aspx?familyid=5148B887-F323-4ADB-9721-61E1C0CFD213

Microsoft Visual Studio .NET 2002 SP1:
http://www.microsoft.com/downloads/details.aspx?familyid=7848A652-4025-44BB-9C98-37A078B56D01

Microsoft Visual Studio .NET 2003 SP1:
http://www.microsoft.com/downloads/details.aspx?familyid=9BC1E8F8-6C30-4AA0-90F5-FBB0AD5FD90E

Microsoft Visual Studio 2005 SP1:
http://www.microsoft.com/downloads/details.aspx?familyid=A7BF790B-3249-4EE8-9440-FA911EBBC08A

Microsoft Visual Studio 2008:
http://www.microsoft.com/downloads/details.aspx?familyid=A8C80B29-6D00-4949-A005-5D706122919A

Microsoft Report Viewer 2005 SP1 Redistributable Package:
http://www.microsoft.com/downloads/details.aspx?familyid=82833F27-081D-4B72-83EF-2836360A904D

Microsoft Report Viewer 2008 Redistributable Package:
http://www.microsoft.com/downloads/details.aspx?familyid=6AE0AA19-3E6C-474C-9D57-05B2347456B1

Microsoft Visual FoxPro 8.0 SP1 (Windows 2000 SP4):
http://www.microsoft.com/downloads/details.aspx?familyid=1F4371B9-B8BE-4455-94D2-2304EE340543

Microsoft Visual FoxPro 9.0 SP1 (Windows 2000 SP4):
http://www.microsoft.com/downloads/details.aspx?familyid=49B21E30-722D-446E-9020-ACEB3870DB69

Microsoft Visual FoxPro 9.0 SP2 (Windows 2000 SP4):
http://www.microsoft.com/downloads/details.aspx?familyid=36957F47-9D8B-477D-BD60-5959E5A2EAFA

Microsoft Platform SDK Redistributable: GDI+:
http://www.microsoft.com/downloads/details.aspx?FamilyId=6A63AB9C-DF12-4D41-933C-BE590FEAA05A

Microsoft Forefront Client Security 1.0 (Windows 2000 SP4):
http://www.microsoft.com/downloads/details.aspx?familyid=1EB1A79F-44CA-499E-90BB-AC51894E9D1E

PROVIDED AND/OR DISCOVERED BY:
1) The vendor credits Greg MacManus, iDefense Labs.
2) The vendor credits Bing Liu, Fortinet.
3) The vendor credits Ivan Fratric via ZDI and Peter Winter-Smith,
NGSSoftware.
4) The vendor credits Assurent Secure Technologies.
5) The vendor credits an anonymous person via ZDI.

ORIGINAL ADVISORY:
MS08-052 (KB954593):
http://www.microsoft.com/technet/security/Bulletin/MS08-052.mspx

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------