|
Description
|
This indicates an attempt to exploit a remote code-execution vulnerability in Microsoft Graphics Device Interface (GDI).
The vulnerability is due to an error in the way that the GDI handles integer calculations. This allows a malicious EMF or WMF image file to overwrite heap memory. By exploiting this a remote attacker may be able to execute arbitrary code and gain control of vulnerable systems.
|
|
|
|
Impact
|
System Compromise: remote code execution.
|
|
|
|
Affected Products
|
Microsoft Windows XP Tablet PC Edition SP2
Microsoft Windows XP Professional x64 Edition SP2
Microsoft Windows XP Professional SP2
Microsoft Windows XP Media Center Edition SP2
Microsoft Windows XP Home SP2
Microsoft Windows Vista Ultimate 64-bit edition SP1
Microsoft Windows Vista Ultimate 64-bit edition 0
Microsoft Windows Vista Home Premium 64-bit edition SP1
Microsoft Windows Vista Home Premium 64-bit edition 0
Microsoft Windows Vista Home Basic 64-bit edition SP1
Microsoft Windows Vista Home Basic 64-bit edition 0
Microsoft Windows Vista Enterprise 64-bit edition SP1
Microsoft Windows Vista Enterprise 64-bit edition 0
Microsoft Windows Vista Business 64-bit edition SP1
Microsoft Windows Vista Business 64-bit edition 0
Microsoft Windows Vista Ultimate SP1
Microsoft Windows Vista Ultimate
Microsoft Windows Vista SP 1
Microsoft Windows Vista Home Premium SP1
Microsoft Windows Vista Home Premium
Microsoft Windows Vista Home Basic SP1
Microsoft Windows Vista Home Basic
Microsoft Windows Vista Enterprise SP1
Microsoft Windows Vista Enterprise
Microsoft Windows Vista Business SP1
Microsoft Windows Vista Business
Microsoft Windows Vista 0
Microsoft Windows Server 2008 Standard Edition 0
Microsoft Windows Server 2008 Enterprise Edition 0
Microsoft Windows Server 2008 Datacenter Edition 0
Microsoft Windows Server 2003 x64 SP2
Microsoft Windows Server 2003 Web Edition SP2
Microsoft Windows Server 2003 Web Edition SP1
Microsoft Windows Server 2003 Standard Edition SP2
Microsoft Windows Server 2003 Standard Edition SP1
Microsoft Windows Server 2003 Itanium SP2
Microsoft Windows Server 2003 Itanium SP1
Microsoft Windows Server 2003 Enterprise x64 Edition SP2
Microsoft Windows Server 2003 Enterprise Edition Itanium SP1
Microsoft Windows Server 2003 Enterprise Edition SP1
Microsoft Windows Server 2003 Datacenter x64 Edition SP2
Microsoft Windows Server 2003 Datacenter Edition Itanium SP1
Microsoft Windows Server 2003 Datacenter Edition SP1
Microsoft Windows 2000 Server SP4
Microsoft Windows 2000 Professional SP4
Microsoft Windows 2000 Datacenter Server SP4
Microsoft Windows 2000 Advanced Server SP4
3DM Software Disk Management Software SP2
3DM Software Disk Management Software SP1
|
|
Aliases
|
MS.GDI.CreateDIBPatternBrushPt.Function.Heap.Overflow
|
|
References
|
http://www.microsoft.com/technet/security/Bulletin/MS08-021.mspx
http://www.securityfocus.com/bid/28571
http://www.frsirt.com/english/advisories/2008/1145
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2008-1083
http://www.zerodayinitiative.com/advisories/ZDI-08-020/
|
|
Recommended Actions
|
Microsoft released fixes and a security bulletin to address this issue.
Microsoft Windows Server 2003 Datacenter Edition SP1
Microsoft Security Update for Windows Server 2003 (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=bee91d80-d49a -4d3d-82d6-d5aa63f54979
Microsoft Windows Server 2003 Enterprise Edition SP1
Microsoft Security Update for Windows Server 2003 (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=bee91d80-d49a -4d3d-82d6-d5aa63f54979
Microsoft Windows Vista SP 1
Microsoft Security Update for Windows Vista (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=9b51deb8-3873 -4146-977f-7e3d0840a4c5
Microsoft Windows XP Media Center Edition SP2
Microsoft Security Update for Windows XP (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=c2763dd8-a03e -4a48-aa86-a7ec00250a7a
Microsoft Windows Server 2003 Itanium SP1
Microsoft Security Update for Windows Server 2003 for Itanium (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=7886a802-f2b5 -489c-b14b-631f4c4c0742
Microsoft Windows Vista Home Basic
Microsoft Security Update for Windows Vista (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=9b51deb8-3873 -4146-977f-7e3d0840a4c5
Microsoft Windows Vista Business SP1
Microsoft Security Update for Windows Vista (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=9b51deb8-3873 -4146-977f-7e3d0840a4c5
Microsoft Windows 2000 Advanced Server SP4
Microsoft Security Update for Windows 2000 (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=caac000a-22b6 -48cb-aa00-1a0bfe886de2
Microsoft Windows Server 2003 Enterprise Edition Itanium SP1
Microsoft Security Update for Windows Server 2003 for Itanium (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=7886a802-f2b5 -489c-b14b-631f4c4c0742
Microsoft Windows Vista Ultimate
Microsoft Security Update for Windows Vista (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=9b51deb8-3873 -4146-977f-7e3d0840a4c5
3DM Software Disk Management Software SP2
Microsoft Security Update for Windows Server 2003 (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=bee91d80-d49a -4d3d-82d6-d5aa63f54979
Microsoft Windows Vista Home Premium SP1
Microsoft Security Update for Windows Vista (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=9b51deb8-3873 -4146-977f-7e3d0840a4c5
Microsoft Windows Server 2003 Datacenter x64 Edition SP2
Microsoft Security Update for Windows Server 2003 x64 Edition (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=e3dde449-e062 -4ce0-a9f4-433bff23e224
Microsoft Windows Server 2003 Standard Edition SP2
Microsoft Security Update for Windows Server 2003 (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=bee91d80-d49a -4d3d-82d6-d5aa63f54979
Microsoft Windows XP Home SP2
Microsoft Security Update for Windows XP (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=c2763dd8-a03e -4a48-aa86-a7ec00250a7a
3DM Software Disk Management Software SP1
Microsoft Security Update for Windows Server 2003 (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=bee91d80-d49a -4d3d-82d6-d5aa63f54979
Microsoft Windows 2000 Datacenter Server SP4
Microsoft Security Update for Windows 2000 (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=caac000a-22b6 -48cb-aa00-1a0bfe886de2
Microsoft Windows Vista Home Basic SP1
Microsoft Security Update for Windows Vista (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=9b51deb8-3873 -4146-977f-7e3d0840a4c5
Microsoft Windows XP Tablet PC Edition SP2
Microsoft Security Update for Windows XP (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=c2763dd8-a03e -4a48-aa86-a7ec00250a7a
Microsoft Windows Server 2003 Itanium SP2
Microsoft Security Update for Windows Server 2003 for Itanium (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=7886a802-f2b5 -489c-b14b-631f4c4c0742
Microsoft Windows Server 2008 Standard Edition 0
Microsoft Security Update for Windows Server 2008 (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=006d5c47-53e6 -4ee1-932c-497611804938
Microsoft Windows Server 2003 Web Edition SP1
Microsoft Security Update for Windows Server 2003 (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=bee91d80-d49a -4d3d-82d6-d5aa63f54979
Microsoft Windows Server 2003 Web Edition SP2
Microsoft Security Update for Windows Server 2003 (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=bee91d80-d49a -4d3d-82d6-d5aa63f54979
Microsoft Windows Vista Home Premium
Microsoft Security Update for Windows Vista (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=9b51deb8-3873 -4146-977f-7e3d0840a4c5
Microsoft Windows Server 2003 Standard Edition SP1
Microsoft Security Update for Windows Server 2003 (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=bee91d80-d49a -4d3d-82d6-d5aa63f54979
Microsoft Windows XP Professional x64 Edition SP2
Microsoft Security Update for Windows XP x64 Edition (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=166f2ab5-913c -47a9-86fe-b814797b751e
Microsoft Windows Vista Enterprise
Microsoft Security Update for Windows Vista (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=9b51deb8-3873 -4146-977f-7e3d0840a4c5
Microsoft Windows Server 2003 Datacenter Edition Itanium SP1
Microsoft Security Update for Windows Server 2003 for Itanium (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=7886a802-f2b5 -489c-b14b-631f4c4c0742
Microsoft Windows XP Professional SP2
Microsoft Security Update for Windows XP (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=c2763dd8-a03e -4a48-aa86-a7ec00250a7a
Microsoft Windows Vista Business
Microsoft Security Update for Windows Vista (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=9b51deb8-3873 -4146-977f-7e3d0840a4c5
Microsoft Windows Vista 0
Microsoft Security Update for Windows Vista (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=9b51deb8-3873 -4146-977f-7e3d0840a4c5
Microsoft Windows Server 2003 x64 SP2
Microsoft Security Update for Windows Server 2003 x64 Edition (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=e3dde449-e062 -4ce0-a9f4-433bff23e224
Microsoft Windows 2000 Server SP4
Microsoft Security Update for Windows 2000 (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=caac000a-22b6 -48cb-aa00-1a0bfe886de2
Microsoft Windows Server 2003 Enterprise x64 Edition SP2
Microsoft Security Update for Windows Server 2003 x64 Edition (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=e3dde449-e062 -4ce0-a9f4-433bff23e224
Microsoft Windows Vista Ultimate SP1
Microsoft Security Update for Windows Vista (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=9b51deb8-3873 -4146-977f-7e3d0840a4c5
Microsoft Windows Server 2008 Datacenter Edition 0
Microsoft Security Update for Windows Server 2008 (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=006d5c47-53e6 -4ee1-932c-497611804938
Microsoft Windows 2000 Professional SP4
Microsoft Security Update for Windows 2000 (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=caac000a-22b6 -48cb-aa00-1a0bfe886de2
Microsoft Windows Server 2008 Enterprise Edition 0
Microsoft Security Update for Windows Server 2008 (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=006d5c47-53e6 -4ee1-932c-497611804938
Microsoft Windows Vista Enterprise SP1
Microsoft Security Update for Windows Vista (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=9b51deb8-3873 -4146-977f-7e3d0840a4c5
|
