Security News -  Security Reviews -   Exploits -  Tools -  UNIX Focus -  Windows Focus
Home  Ask the Team  Mailing Lists  Advertising Info  Advisories  About SecuriTeam  Blogs Brought to you by: Suppliers of: Website Testing Tools Network Testing Tools Software Testing Tools SecuriTeam in Your Inbox New vulnerability? New tool? Tell us (Our PGP key). Network Enabled Discount: SecuriTeam5_SANS Promo With Us Subjects of Interest: Vulnerability Management SQL Injection Buffer Overflows Active Network Scanning Fuzzing Fuzzer Report Network Security Network Scanner Pen Testing Security Scanner Scanner Review Fuzzer Review Web Scanner Review	Microsoft Windows Color Management Module Heap Buffer Overflow Vulnerability (MS08-046) 13 Aug. 2008    Summary Microsoft Windows Color Management Module provides "consistent color mappings between different devices and applications. It is also used to transform colors between color spaces". Remote exploitation of a heap-based buffer overflow vulnerability in multiple versions of Microsoft Corp.'s Windows operating system allows an attacker to execute arbitrary code with the privileges of the current user.   Credit: The information has been provided by iDefense Labs Security Advisories. The original article can be found at: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=742 Free Website Security Scan Free Fuzzer Report Vulnerability Assessment Detect web app vulnerabilities University study comparing the top Accurate and automated scanning Get guidance from professionals. 6 commercially availble fuzzers. for networks of any size.    Details Protect your website! Free Trial, Nothing to install. No interruption of visitors. www.beyondsecurity.com/vulnerability-scanner Vulnerable Systems:  * Windows 2000 Service Pack 4  * Windows XP Service Pack 2  * Windows Server 2003 Service Pack 1  * Windows Server 2003 Service Pack 2 Immune Systems:  * Windows Vista  * Windows Vista Service Pack 1  * Windows Server 2008 This vulnerability specifically exists in the InternalOpenColorProfile function in mscms.dll. When a malformed parameter is supplied, a heap-based buffer overflow can occur, resulting in an exploitable condition. Analysis: Exploitation allows an attacker to execute arbitrary code with the privileges of the current user. Exploitation would require convincing a targeted user to view a malicious image file either hosted on a Web server, on local file system or embedded in an-email or Office documents, or through some form of social engineering. This vulnerability also can be triggered through e-mail. If the e-mail client can automatically display images embedded in the e-mail, the user only needs to open the e-mail to trigger the vulnerability. Currently an EMF file is used as test attack vector. Outlook and Outlook Express will automatically display EMF image and trigger the vulnerability. Lotus Notes and Thunderbird do not display EMF images in e-mail directly, but the vulnerability still can be triggered when opening or viewing the EMF attachment. Workaround: In order to prevent exploitation of this vulnerability, turn off metafile processing by modifying the registry. Under the registry key, "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize" create a DWORD entry "DisableMetaFiles" and set it to 1. Keep in mind that this only blocks the attack vector through Windows metafiles. It may be possible to exploit this vulnerability through other attack vectors. Note: Modifying the registry does not affect processes that are already running, so you may need to log off and log on again or restart the computer after making the change. Implementing this workaround may cause components relying on metafile processing, such as printing, to misbehave. Viewing e-mail in plain text format mitigates e-mail-based attack. Vendor response: Microsoft has officially addressed this vulnerability with Security Bulletin MS08-046. For more information, consult their bulletin at the following URL: http://www.microsoft.com/technet/security/bulletin/ms08-046.mspx CVE Information: CVE-2008-2245 Disclosure timeline: 04/10/2008 - Initial vendor notification 04/16/2008 - Initial vendor response 08/12/2008 - Coordinated public disclosure  Comments: blog comments powered by Disqus	Related Articles Microsoft Windows Local Privilege Escalation Vulnerabilities Microsoft Office Use After Free Memory Corruption Vulnerabilities Microsoft Internet Explorer Execute Arbitrary Code Remote Memory Corruption Vulnerabilities Microsoft Internet Explorer Cross-Domain Information Disclosure Vulnerabilities Microsoft Windows TCP/IP Stack Privilege Escalation Vulnerabilities Microsoft Windows OLE Code Execution Vulnerabilities Microsoft Internet Explorer Cross-Domain Execute Arbitrary Code Vulnerabilities Microsoft SharePoint Server Privilege Escalation Vulnerabilities Microsoft Office Invalid Pointer Memory Corruption Vulnerabilities Microsoft Internet Explorer Privilege Escalation Vulnerabilities Microsoft Windows Kernel Mode Driver Denial Of Service Vulnerabilities Microsoft Secure Channel Code Execution Vulnerabilities Microsoft Internet Explorer Denial-Of-Service Memory Corruption Vulnerabilities Microsoft Internet Explorer Cross-Domain Obtain Sensitive Information Vulnerabilities Microsoft OLE Automation Array Code Execution Vulnerabilities Microsoft XML Core Services Remote Code Execution Vulnerabilities Microsoft Internet Explorer Cross-Domain Memory Corruption Vulnerabilities Microsoft Windows Kerberos Checksum Remote Privilege Escalation Vulnerabilities Microsoft Windows Audio Service Privilege Escalation Vulnerabilities Microsoft Input Method Editor (IME) For Japanese Remote Privilege Escalation Vulnerabilities  Featured Articles Microsoft Windows Graphics Component Remote Code Execution Vulnerabilities Microsoft Windows Local Remote Procedure Call (LRPC) Server Spoofing LPC Port Message Handling Local Stack Buffer Overflow Vulnerability Microsoft SharePoint Server Multiple Component Crafted Page Content Handling Remote Code Execution Vulnerability Microsoft Windows Win32k.sys RFONTOBJ bTextExtent Function Handling Local Integer Overflow DoS Vulnerability Microsoft Windows Kernel Memory Object Handling Race Condition Local Privilege Escalation (2013-1294) Vulnerability Microsoft Windows Win32k.sys Memory Object Handling Race Condition Local Privilege Escalation (2013-1283) Vulnerability Microsoft Visio Viewer Tree Object Type Confusion Visio File Handling Arbitrary Code Vulnerability Microsoft Office for Mac HTML5 Email Message Unspecified Content Tag Loading Information Disclosure Vulnerability Microsoft SharePoint Callback Function URL Handling Privilege Escalation Vulnerability Microsoft Windows USB Driver Memory Object Handling Local Privilege (2013-1287) Vulnerability Microsoft Windows USB Driver Memory Object Handling Local Privilege Escalation Vulnerability Microsoft Windows Kernel Memory Object Handling Local Privilege Escalation Vulnerability Microsoft Windows SSL/TSL Forced Downgrade MitM Weakness Microsoft Windows Memory Object Handling Local Memory Privilege Escalation Vulnerability Microsoft Windows Privilege Escalation Vulnerability Microsoft .NET Framework Serialization Remote Code Execution Vulnerability Microsoft Visio Viewer VSD File Format Remote Code Execution Vulnerability Microsoft .NET Framework Input Serialization CVE-2012-0160 Remote Code Execution Vulnerability Microsoft .NET Framework ASP.NET Forms Authentication Bypass Vulnerability 'TrendMicro Control Manager CASProcessor.exe BLOB Code Execution Vulnerability'
	Security News - Security Reviews - Exploits - Tools - UNIX Focus - Windows Focus - Blogs - CVEs

Copyright © Beyond Security® All rights reserved.
Terms of Use Site Privacy Statement.
SecuriTeam™ is a trademark of Beyond Security®