Microsoft Windows Malformed ART Image Remote Code Execution Vulnerability

2006-06-13T00:00:00
ID SMNTC-18394
Type symantec
Reporter Symantec Security Response
Modified 2006-06-13T00:00:00

Description

Description

Microsoft Windows is prone to remote code execution when processing malformed AOL ART images. This issue is exposed when the malicious images are processed by Internet Explorer or other applications that rely on Internet Explorer to display AOL ART images. If exploited, this vulnerability could let a remote attacker execute arbitrary code in the context of the victim user.

Technologies Affected

  • Microsoft Internet Explorer 5.0.1
  • Microsoft Internet Explorer 5.0.1 SP1
  • Microsoft Internet Explorer 5.0.1 SP2
  • Microsoft Internet Explorer 5.0.1 SP3
  • Microsoft Internet Explorer 5.0.1 SP4
  • Microsoft Internet Explorer 6.0
  • Microsoft Internet Explorer 6.0 SP1
  • Microsoft Windows Server 2003 Datacenter Edition
  • Microsoft Windows Server 2003 Datacenter Edition Itanium
  • Microsoft Windows Server 2003 Datacenter Edition Itanium SP1
  • Microsoft Windows Server 2003 Datacenter Edition SP1
  • Microsoft Windows Server 2003 Datacenter x64 Edition
  • Microsoft Windows Server 2003 Enterprise Edition
  • Microsoft Windows Server 2003 Enterprise Edition Itanium
  • Microsoft Windows Server 2003 Enterprise Edition Itanium SP1
  • Microsoft Windows Server 2003 Enterprise Edition SP1
  • Microsoft Windows Server 2003 Enterprise x64 Edition
  • Microsoft Windows Server 2003 Standard Edition
  • Microsoft Windows Server 2003 Standard Edition SP1
  • Microsoft Windows Server 2003 Standard x64 Edition
  • Microsoft Windows Server 2003 Web Edition
  • Microsoft Windows Server 2003 Web Edition SP1
  • Microsoft Windows XP 64-bit Edition
  • Microsoft Windows XP 64-bit Edition SP1
  • Microsoft Windows XP
  • Microsoft Windows XP Home
  • Microsoft Windows XP Home SP1
  • Microsoft Windows XP Home SP2
  • Microsoft Windows XP Media Center Edition
  • Microsoft Windows XP Media Center Edition SP1
  • Microsoft Windows XP Media Center Edition SP2
  • Microsoft Windows XP Professional
  • Microsoft Windows XP Professional SP1
  • Microsoft Windows XP Professional SP2
  • Microsoft Windows XP Professional x64 Edition
  • Microsoft Windows XP Tablet PC Edition
  • Microsoft Windows XP Tablet PC Edition SP1
  • Microsoft Windows XP Tablet PC Edition SP2

Recommendations

Do not accept or execute files from untrusted or unknown sources.
This issue may be exploited via malicious Media Player content. Users are advised to avoid opening any unsolicited or unexpected files, especially if they arrive from an unfamiliar source. This may limit exposure to this vulnerability.

Do not follow links provided by unknown or untrusted sources.
This issue may be exploited via a malicious website. Users should be wary of visiting websites of questionable integrity, especially if solicited to do so by an untrusted or unfamiliar source.

Implement multiple redundant layers of security.
Deploy host-based intrusion-prevention systems that employ such features as memory protection. This may complicate exploitation of memory protection by providing non-executable stacks/heaps and randomly mapped memory segments.

Run all software as a nonprivileged user with minimal access rights.
Perform all non-administrative tasks as an unprivileged user with minimal access rights. This may limit the impact of latent vulnerabilities in applications.

Microsoft has released a security bulletin and fixes to address this issue.