SB2008120901 - Two remote code execution vulnerabilities in Microsoft Windows

Description

This security bulletin contains information about 2 vulnerabilities.

1) Heap-based buffer overflow (CVE-ID: CVE-2008-3465)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to heap-based buffer overflow in gdi32.dll. By persuading the victim to open a specially crafted WMF image file containing a malformed header, a remote attacker can cause memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

2) Integer Overflow or Wraparound (CVE-ID: CVE-2008-2249)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to integer overflow when processing malformed WMF image file. By persuading the victim to open a specially crafted WMF image file containing a malformed header, a remote attacker can cause memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: according to reports this vulnerability was being actively exploited before Microsoft issued security patch.

Remediation

Install update from vendor's website.

References

• https://technet.microsoft.com/en-us/library/security/ms08-071.aspx
• https://fe-ddis.dk/cfcs/CFCSDocuments/Zeroday.pdf