Vulnerability Note VU#290961
Microsoft Windows GDI+ ICO InfoHeader Height division by zero vulnerability
Microsoft Windows GDI+ fails to properly handle ICO files, which could allow a remote, unauthenticated attacker to cause a denial-of-service condition.
Microsoft Windows Graphics Device Interface (GDI+) is an application programming interface (API) that provides programmers the ability to display information on screens and printers. GDI+ includes the ability to process ICO (icon) image files. There is an integer division by zero vulnerability in the way the ICO parsing component of GDI+ (Gdiplus.dll) handles ICO files with a Height value of zero in the InfoHeader section of the ICO file. By introducing a specially crafted ICO file to the vulnerable component, a remote attacker could trigger an integer division by zero denial-of-service condition.
Windows Explorer has been shown to be vulnerable, however any application that uses the GDI+ library may be vulnerable.
A remote, unauthenticated attacker may be able to cause a denial-of-service condition on a vulnerable system by introducing a specially crafted ICO file. The affected application would crash with a "division by zero" error. In the case of Windows Explorer, simply having the file on the desktop or any other location that is displayed by Explorer is enough to trigger the vulnerability.
We are currently unaware of a practical solution to this problem.
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Microsoft Corporation||Affected||03 May 2007||06 Jun 2007|
CVSS Metrics (Learn More)
Thanks to Dennis Rand of CSIS Security Group for reporting this vulnerability.
This document was written by Will Dormann.
- CVE IDs: CVE-2007-2237
- Date Public: 06 Jun 2007
- Date First Published: 06 Jun 2007
- Date Last Updated: 06 Jun 2007
- Severity Metric: 5.54
- Document Revision: 16
If you have feedback, comments, or additional information about this vulnerability, please send us email.