Microsoft GDI+pictures loophole details-vulnerability warning-the black bar safety net

ID MYHACK58:62200820510
Type myhack58
Reporter 佚名
Modified 2008-09-25T00:00:00


What is GDI+: the GDI+ is a Graphics Device Interface to applications and programmers to provide a two-dimensional vector graphics, imaging, and typography.

Vulnerability impact: Microsoft products are used in the GDI+library GdiPlus.dll through class-based API provides a variety of graphical ways of access. The GDI+library when parsing a specially crafted BMP file when there is an integer overflow vulnerability, if the file contains a malformed BitMapInfoHeader, then it will lead to incorrect integer calculations, the final trigger can be the use of memory destruction. Successful exploitation of this vulnerability an attacker could take complete control of an affected system. If the user is using the Affected Software to view a specially crafted image file or browse containing a specially crafted content to the site, the vulnerabilities could allow remote code execution. An attacker could then install programs; view, change, or delete data; or create with full user permissions to the new account. Those accounts are configured to have fewer user rights on the system than users with administrative user rights affected should be small.

Affected Picture format: The gdi+vulnerability is very serious, similar to the previous cursor vulnerability and the wmf vulnerability, relates to the format of the wider bmp\wmf\gif\emf\vml)

Microsoft to third-party applications recommendations: ★I is a third-party application developer, my applications use gdiplus.dll the. My application is vulnerable to attack, how to update? Re-distribution gdiplus.dll the developer should make sure that they download through this Bulletin provides updates to the update with the app installed gdiplus.dll version. Encourage developers to follow to use shared components of the recommended best solution to perform the operation. Related to the use of shared components of the best practices for more information, see About isolated applications in the Microsoft Knowledge Base Article 8 3 5 3 2 2。

★I am developing contains the Redistributable files gdiplus.dll software. What should I do? You should for your development of software installation in this Bulletin provide security updates. If you have already with your application re-distribution. gdiplus.dll you should use for your development software download this security update to get this file updated version to your customers publish your app to the updated version.

★If third party applications use or install the affected gdiplus.dll Assembly, then install all required Microsoft Security Updates is still vulnerable to attack? No, this security update replaces and re-registers with theoperating systemprovided by the affected component. If third party applications follow the recommended best practices for using a shared component used as a parallel component, then they will not be affected. If third party applications do not follow the recommended best practices, but with its application together to re-distribute. gdiplus.dll the older version, then the client may be threatened. Microsoft Knowledge Base Article 9 5 4 5 9 3 also contains for you want to manually check for the registered affected OLE component description. Customers are encouraged to contact their third party solutions developer for additional information.