Windows Metafile AttemptWrite Heap Overflow

最新推荐文章于 2025-08-09 12:48:46 发布

iiprogram

最新推荐文章于 2025-08-09 12:48:46 发布

阅读量756

点赞数

文章标签： windows security microsoft buffer integer network

本文分析了一个在 Windows 图形设备接口 (GDI) 中发现的堆溢出漏洞，该漏洞允许攻击者通过恶意元文件执行任意代码。漏洞源于 GDI32 函数 AttemptWrite 的整数溢出问题。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

Release Date:
August 14, 2007

Date Reported:
March 27, 2007

Severity:
High (Code Execution)

Systems Affected:
Windows 2000 SP4
Windows XP SP2
Windows Server 2003 SP1

Overview:
eEye Digital Security has discovered a heap overflow vulnerability in
the way the Windows Graphical Device Interface (GDI) processes Windows
metafiles. If an application attempts to display a malicious metafile
in a particular way, a heap overflow will occur and result in the
execution of arbitrary code, with the privileges of the user who ran the
application.

Technical Details:
The GDI32 function AttemptWrite is susceptible to a heap overflow
vulnerability caused by an integer overflow, as depicted in the
disassembly below. The AttemptWrite function is called by multiple
GDI32 API functions, most notably CreateMetaFileW.

    77F4B519 mov esi, [ebp+0Ch] ; reported size of record in bytes
     ...                           ;   (user-controlled)
    77F4B548 mov eax, [ebx+0Ch] ; amount of buffer used in bytes
                                   ;   (user-controlled)
    77F4B548 lea ecx, [eax+esi] ; *** integer overflow ***
    77F4B54E cmp ecx, [ebx+08h] ; buffer capacity
    77F4B551 ja   _no_memcpy
     ...
    77F4B56D mov edi, [ebx]      ; pointer to start of buffer
    77F4B56F mov ecx, esi
    77F4B574 add edi, eax        ; now EDI points to unused buffer
space
     ...
    77F4B5BA mov eax, ecx
    77F4B5BC shr ecx, 2
    77F4B5BF rep movsd            ; *** complete heap overwrite ***

By constructing a metafile containing an extremely large record length,
a complete heap overwrite may occur, due to the intrinsic memcpy
attempting to copy roughly 4GB of arbitrary data into a heap block.
Because of the size of the copy, an access violation is inevitable, but
in programs (such as Microsoft Office applications) that attempt to
handle the exception, successful exploitation has been demonstrated.

Protection:
Retina Network Security Scanner has been updated to identify this
vulnerability.
Blink Endpoint Vulnerability Prevention preemptively protects from this
vulnerability.

Vendor Status:
Microsoft has released a patch for this vulnerability. The patch is
available at:
http://www.microsoft.com/technet/security/bulletin/MS07-046.mspx

Credit:
Yuji Ukai

Related Links:
Retina - Network Security Scanner - Free Trial:
http://www.eeye.com/html/products/retina/download/index.html
Blink - Unified Client Security Personal - Free For Home Use:
http://www.eeye.com/html/products/blink/personal/download/index.html
Blink - Unified Client Security Professional - Free Trial:
http://www.eeye.com/html/products/blink/download/index.html