iDefense Security Advisory 09.09.08
http://labs.idefense.com/intelligence/vulnerabilities/
Sep 09, 2008

I. BACKGROUND

The GDI+ library, or "GdiPlus.dll", provides access to a number of
graphics methods, via a class-based API. Vector Markup Language (VML)
is a component of the Extensible Markup Language (XML) that specifies
vector images (e.g., rectangles and ovals) using the GDI+ API. For more
information about these technologies, visit the following URLs.

http://msdn.microsoft.com/en-us/library/ms533797(VS.85).aspx
http://msdn.microsoft.com/en-us/library/ms533798(VS.85).aspx
http://www.w3.org/TR/1998/NOTE-VML-19980513
http://en.wikipedia.org/wiki/Vector_Markup_Language

II. DESCRIPTION

Remote exploitation of an integer overflow vulnerability in multiple
versions of Microsoft Corp.'s GDI+ could allow an attacker to execute
arbitrary code within the context of the local user.

The vulnerability specifically exists in the memory allocation performed
by the GDI+ library. Certain malformed gradient fill input can cause the
application to corrupt the heap, potentially allowing arbitrary code
execution.

III. ANALYSIS

Exploitation of this vulnerability may allow an attacker to execute
arbitrary code in the context of the current user. To exploit this
vulnerability, the attacker would need to convince a targeted user to
render a document with an application that utilizes the vulnerable GDI+
functions. This could be accomplished by persuading the user to follow a
link, view a document, or read an e-mail message.

IV. DETECTION

iDefense Labs confirmed this vulnerability affects Internet Explorer 7
and Internet Explorer 6 on the Microsoft Windows XP SP2 platform. The
following versions of VGX.DLL were tested and found to be vulnerable:

  7.00.6000.20628
  7.00.6000.16386
  6.00.2900.3051
  6.00.2900.2997

While the VGX.DLL library (which handles VML) appears to be the most
likely vector, Microsoft have indicated to us that the GdiPlus.dll is
the root cause of the vulnerability. Version 5.1.3102.2180 of
GdiPlus.dll was installed on each of the tested systems.

V. WORKAROUND

In order to prevent exploitation of this vulnerability, unregister or
deny access to vgx.dll and/or gdiplus.dll. Note that doing so will
prevent proper rendering of documents that rely on the affected
component.

VI. VENDOR RESPONSE

Microsoft has officially addressed this vulnerability with Security
Bulletin MS08-052. For more information, consult their bulletin at the
following URL.

http://www.microsoft.com/technet/security/bulletin/ms08-052.mspx

VII. CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2007-5348 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org/), which standardizes names for
security problems.

VIII. DISCLOSURE TIMELINE

05/09/2007  Initial vendor notification
05/09/2007  Initial vendor response
09/09/2008  Coordinated public disclosure

IX. CREDIT

This vulnerability was discovered by Greg MacManus during his tenure
with iDefense Labs.

Get paid for vulnerability research
http://labs.idefense.com/methodology/vulnerability/vcp.php

Free tools, research and upcoming events
http://labs.idefense.com/

X. LEGAL NOTICES

Copyright © 2008 iDefense, Inc.

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDefense. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically,
please e-mail customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
 There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct,
indirect, or consequential loss or damage arising from use of, or
reliance on, this information.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/