Microsoft Windows GDI+ fails to properly handle ICO files, which could allow a remote, unauthenticated attacker to cause a denial-of-service condition.
Microsoft Windows Graphics Device Interface (GDI+) is an application programming interface (API) that provides programmers the ability to display information on screens and printers. GDI+ includes the ability to process ICO (icon) image files. There is an integer division by zero vulnerability in the way the ICO parsing component of GDI+ (Gdiplus.dll) handles ICO files with a Height value of zero in the InfoHeader section of the ICO file. By introducing a specially crafted ICO file to the vulnerable component, a remote attacker could trigger an integer division by zero denial-of-service condition.
Windows Explorer has been shown to be vulnerable, however any application that uses the GDI+ library may be vulnerable.
A remote, unauthenticated attacker may be able to cause a denial-of-service condition on a vulnerable system by introducing a specially crafted ICO file. The affected application would crash with a "division by zero" error. In the case of Windows Explorer, simply having the file on the desktop or any other location that is displayed by Explorer is enough to trigger the vulnerability.
We are currently unaware of a practical solution to this problem.
Thanks to Dennis Rand of CSIS Security Group for reporting this vulnerability.
This document was written by Will Dormann.
|Date First Published:||2007-06-06|
|Date Last Updated:||2007-06-06 14:18 UTC|