|
|
|
|
| |
Credit:
The information has been provided by ZERT.
For the paper's latest version, please visit: http://isotf.org/zert/papers/vml-details-20060928.pdf.
|
| |
This document provides a brief, quasi-technical analysis of CVE-2006-4868. The purpose is to disseminate information on the particular vulnerability and to assist with understanding of how the ZERT patch was designed to mitigate the flaw.
Introduction
The vulnerability in Microsoft's Vector Graphics Rendering Engine (vgx.dll) exists due to an overzealous for() loop that copies data from a large, dynamically allocated buffer into an inadequate, fixed-size buffer on the stack. The data being copied in this routine is usersupplied as a Vector Markup Language (VML) fill method attribute. Legitimate values for the attribute include none , any , linear, and sigma. A vulnerable version of the library will copy the user-supplied string without checking its size, allowing a malicious document containing an overly-long fill method string to cause data to be written outside of the destination buffer s boundaries.
The ZERT patch for this vulnerability adds a check to the code before it can begin execution of the described loop. If the length of the user-supplied fill method string is greater than 512 bytes (size of destination buffer), the loop is avoided by making a jump to the function s cleanup instructions, and subsequently returns null. The function could return null for serveral reasons; such as if the fill method string does not contain any characters. By handling the overly-long string condition in this manner, we can be relatively certain that nothing out of the ordinary will happen. After patching, the library function will react to overly-long fill method strings with the same behavior as it exhibits when the fill method string is null. If the added conditional determines that the string is not greater than 512 bytes, it will allow the library function to enter the copy loop and proceed with normal execution of the program.
You can find the paper here:
http://isotf.org/zert/papers/vml-details-20060928.pdf
|
|
|
|
|
