OSVDB ID: 12842

Title: Microsoft Windows Cursor and Icon Validation Code Execution

Info

Disclosure
Jan 11, 2005

Discovery
Unknown

Dates

Exploit
Jan 12, 2005

Solution
Jan 11, 2005

Description

 A local overflow exists in Windows. USER32.DLL fails to validate the Length_of_AnimationHeader field in .ANI files, which is passed as a length argument to memcpy(). With a specially crafted file, an attacker can cause arbitrary data to write to the stack and execute resulting in a loss of integrity.

Classification

 Location: Local Access Required
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Patch / RCS
Exploit: Exploit Public, Exploit Commercial
Disclosure: OSVDB Verified, Vendor Verified

Solution

 Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability.

Products

Microsoft Corporation

Windows

 NT Server 4.0 SP6
NT Server Terminal Server Edition 4.0 SP6
2000 SP3
2000 SP4
XP SP1
XP 64-Bit SP1
XP 64-Bit 2003
98
98se
Millennium Edition
2003 Server x64
2003 Server

References

Credit
  • Yuji Ukai - alerteEye.com - eEye Digital Security


Direct URL: http://osvdb.org/12842