Windows Metafile Multiple Heap Overflows (MS05-053)
9 Nov. 2005
Summary
Windows Metafile (WMF) is a common graphics file format on Microsoft Windows systems. It is a vector graphics format which also allows the inclusion of raster graphics. Essentially, a WMF file stores a list of commands that have to be issued to the Windows graphics layer GDI in order to restore the image. WMF is a 16-bit format introduced in Microsoft Windows 3; a newer 32-bit version with additional commands is called Enhanced Metafile (EMF). EMF is also used as a graphics language for printer drivers.
A heap overflow vulnerability has been discovered in the way the Windows Graphical Device Interface (GDI) processes Windows enhanced metafile images (file extensions EMF and WMF). An attacker could send a malicious metafile to a victim of his choice over any of a variety of media - such as HTML e-mail, a link to a web page, a metafile-bearing Microsoft Office document, or a chat message in order to execute code on that user's system at the user's privilege level.
Affected Software:
* Microsoft Windows 2000 Service Pack 4 - Update
* Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2 - Update
* Microsoft Windows XP Professional x64 Edition - Update
* Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1 - Update
* Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems - Update
* Microsoft Windows Server 2003 x64 Edition - Update
Non-Affected Software:
* Microsoft Windows 98, Microsoft Windows 98 Second Edition (SE), and Microsoft Windows Millennium Edition (ME)
The Windows metafile rendering code in GDI32.DLL contains a number of integer overflow flaws in its processing of EMF/WMF file data that lead to exploitable heap overflows through any number of specially crafted metafile structures. For example, the following disassembly from MRBP16::bCheckRecord demonstrates a size calculation that is susceptible to integer overflow and as a result may pass validation with a dangerous value:
