AOH :: HP Unsorted W :: C07-1827.HTM

WMF CreateBrushIndirect vulnerability (DoS)
WMF CreateBrushIndirect vulnerability (DoS)
WMF CreateBrushIndirect vulnerability (DoS)

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

The following WMF exploit appeared on milw0rm today: 

The vulnerability is a result of the WMF parser passing a value from the file as
a pointer argument to the CreateBrushIndirect function. The function
dereferences the pointer and dies with an access violation.

The value in the file is only 16-bit and it is sign extended into a 32-bit
pointer. This means that we can only access addresses from 0x00000000 to
0x0000FFFF and from 0xFFFF0000 to 0xFFFFFFFF. Both of these ranges are always
invalid, so the vulnerability is just a DoS.

For more details and some commentary, see: 

Alexander Sotirov
Determina Security Research

Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

Version: GnuPG v1.4.5 (Cygwin)
Comment: Using GnuPG with Mozilla - 



The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH
We do not send spam. If you have received spam bearing an email address, please forward it with full headers to