Microsoft Windows LoadUvsTable() Buffer Overflow

🗓️ 15 Mar 2017 00:00:00Reported by Hossein LotfiType

packetstorm🔗 packetstormsecurity.com👁 46 Views

Microsoft Windows LoadUvsTable() Buffer Overflow, CVE-2016-7274, integer overflow error, heap-based buffer overflow, usp10.dll, proof of concep

Reporter	Title	Published	Views	Family All 34
0day.today	Microsoft Windows - LoadUvsTable() Heap-based Buffer Overflow Vulnerability	16 Mar 201700:00	–	zdt
CNVD	Microsoft Windows Uniscribe Component Remote Code Execution Vulnerability	14 Dec 201600:00	–	cnvd
Check Point Advisories	Microsoft Windows Uniscribe Remote Code Execution (MS16-147: CVE-2016-7274)	13 Dec 201600:00	–	checkpoint_advisories
CVE	CVE-2016-7274	20 Dec 201605:54	–	cve
Cvelist	CVE-2016-7274	20 Dec 201605:54	–	cvelist
Exploit DB	Microsoft Windows - 'LoadUvsTable()' Heap Buffer Overflow	15 Mar 201700:00	–	exploitdb
exploitpack	Microsoft Windows - LoadUvsTable() Heap Buffer Overflow	15 Mar 201700:00	–	exploitpack
GoogleProjectZero	Notes on Windows Uniscribe Fuzzing	10 Apr 201700:00	–	googleprojectzero
Microsoft KB	Security update 2016-12-13	13 Dec 201608:00	–	mskb
Microsoft KB	MS16-148: Description of the security update for Office 2010: December 13, 2016	13 Dec 201608:00	–	mskb

`# Date: 15-03-2017  
# Author: Hossein Lotfi (https://twitter.com/hosselot)  
# CVE: CVE-2016-7274  
  
1. Description  
  
An integer overflow error within the "LoadUvsTable()" function of usp10.dll  
can be exploited to cause a heap-based buffer overflow. Full analysis is  
available at:  
  
http://blogs.flexerasoftware.com/secunia-research/2016/12/microsoft_windows_loaduvstable_heap_based_buffer_overflow_vulnerability.html  
  
  
2. Proof of Concept  
  
open aC:\Windows\Fonts\phagspa.ttfa in a hex editor and change the value at  
offset 0x2051 from 0x00000006 to 0x33333334.  
  
  
3. Solution:  
  
Microsoft initially tried to fixed the issue in MS16-147, but the fix was  
incomplete and the issue remained unpatched til Microsoft March 2017 patch  
release:  
  
https://twitter.com/hosselot/status/809059287037251584  
  
It appears MS17-013 finally fixed the vulnerability properly:  
  
https://technet.microsoft.com/en-us/library/security/ms17-013.aspx  
  
@hosselot  
  
`

15 Mar 2017 00:00Current

0.1Low risk

Vulners AI Score0.1

EPSS0.38401