Vulnerability Note VU#189754

Microsoft Internet Explorer buffer overflow in PNG image rendering component

Overview

A buffer overflow in the PNG image rendering component of Microsoft Internet Explorer (IE) may allow a remote attacker to execute code on a vulnerable system.

I. Description

The Portable Network Graphics (PNG) image format is used as an alternative to other image formats such as the Graphics Interchange Format (GIF). Microsoft Internet Explorer supports PNG image format. The PNG image rendering component of Microsoft Internet Explorer (pngfilt.dll) does not properly handle PNG image files, potentially allowing a buffer overflow to occur. If a remote attacker can persuade a user to access a specially crafted PNG image with IE, that attacker may be able to trigger the buffer overflow.

For more information about affected components, please refer to MS05-025. Please note that Microsoft has reported this issue is distinct from those previously reported in VU#817368 and VU#388984 (CAN-2004-0597).

II. Impact

If a user opens a specially-crafted PNG image using a vulnerable version of Internet Explorer, an attacker may be able execute arbitrary code with the privileges of the user or cause Internet Explorer to terminate.

III. Solution

Apply An Update

Microsoft has addressed this issue in Microsoft Security Bulletin MS05-025.
Microsoft Security Bulletin MS05-025 suggests the following workarounds. While these workarounds will not correct the underlying vulnerability, they help block known attack vectors.

Disable PNG rendering

Until the patch can be applied, you may wish to disable the PNG rendering in IE. To disable the PNG rendering , follow these steps:

Click Start, click Run, type "regsvr32 /u pngfilt.dll" (without the quotation marks), and then click OK.
A dialog box appears to confirm that the unregistration process has succeeded. Click OK to close the dialog box.
Close Internet Explorer, and reopen it for the changes to take effect..

In addition, the following techniques may reduce the likelihood of exploitation:

Read and send email in plain text format

Outlook 2003, Outlook 2002 SP1, and Outlook 6 SP1 can be configured to view email messages in text format. Consider the security of fellow Internet users and send email in plain text format when possible. Note that reading and sending email in plain text will not necessarily prevent exploitation of this vulnerability.

Do not follow unsolicited links

In order to convince users to visit their sites, attackers often use URL encoding, IP address variations, long URLs, intentional misspellings, and other techniques to create misleading links. Do not click on unsolicited links received in email, instant messages, web forums, or internet relay chat (IRC) channels. Type URLs directly into the browser to avoid these misleading links. While these are generally good security practices, following these behaviors will not prevent exploitation of this vulnerability in all cases, particularly if a trusted site has been compromised or allows cross-site scripting.

Systems Affected

Vendor	Status	Date Updated
Microsoft Corporation	Vulnerable	14-Jun-2005

References

http://www.microsoft.com/technet/security/bulletin/ms05-025.mspx

Credit

This vulnerability was reported in Microsoft Security Bulletin MS05-025. Microsoft credits Mark Dowd of ISS X-Force for providing information regarding this vulnerability.

This document was written by Jeff Gennari.

Other Information

Date Public	06/14/2005
Date First Published	06/14/2005 07:33:07 PM
Date Last Updated	06/27/2005
CERT Advisory
CVE Name	CAN-2005-1211
US-CERT Technical Alerts
Metric	22.50
Document Revision	44

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Produced 2005 by US-CERT, a government organization
Disclaimers and copyright information

Get Adobe Reader