Arman Nayyeri
13/04/04, 07:25
Microsoft Internet Explorer BMP file memory DoS vulnerability
================================================== ===========
Title: Microsoft Internet Explorer BMP file memory DoS vulnerability
Vuln Name: 58 bytes BMP vs 51,539,607,528 GB memory
Date: Sunday, April 11, 2004
Software: Internet Explorer v5.0-v6.0
(i guess perior versions are vulnerable)
Vendor: Microsoft Corporation
Patch: N/A (Look at "Vendor Status" section)
Author: Arman Nayyeri, arman[at]4rman.com, http://www.4rman.com
Severity: Low
Description:
============
When a BMP file loaded into the Internet Explorer (for exmaple 'IMG' tag)
the internet explorer check the BMP image size written in BMP file, and then allocate the necessary memory to itself for placing bmp image into
the memory.
And it does not check the actual size of the file, so we can write a large
number in the bmp file and cause the IE to fill the memory up.
But we can't use a very large number because IE will check to see if there is
enough memory available, if not, it doesn't load it at all.
The max size of the bitmap is FFFFFFFF^2 (large number ;) ).
so the tiny (58 bytes) bitmap can take up to 51,539,607,528 GB memory.
Exploit:
========
The exploit that I provided is an html page with many IMG tags that loading
several BMP files with different sizes. So the memory fills up completely.
WARNING!!!!!
This DoS will cause serious system instability, please save your work
before loading this page, you may need to restart your computer!
Here is the page:
http://www.4rman.com/exploits/tinybmp.htm
please, take a look at my website too!
http://www.4rman.com
Exploit Tested On
=================
Internet Explorer 5.5
on
Microsoft Windows 2000 Server SP4
Microsoft Windows ME
Internet Explorer 6.0
on
Microsoft Windows XP
Microsoft Windows XP SP1
Microsoft Windows 2003 Enterprise
Vendor Status
=============
Microsoft notified about 3 month ago.
The bug will be fixed as part of the next possible service pack.
Special Thanks
==============
Special thanks to god.
Do I discover more vulnerabilities?
===================================
Maybe!(heh)
Disclaimer:
===========
Arman Nayyeri is not responsible for the misuse of the information
provided in this advisory. The opinions expressed are my own and not of
any company. In no event shall the author be liable for any damages
whatsoever arising out of or in connection with the use or spread of this
advisory. Any use of the information is at the user's own risk.
~~~~~~~~~~~~~~
and sorry for my bad english,
Arman Nayyeri
From
Iran
http://www.4rman.com
================================================== ===========
Title: Microsoft Internet Explorer BMP file memory DoS vulnerability
Vuln Name: 58 bytes BMP vs 51,539,607,528 GB memory
Date: Sunday, April 11, 2004
Software: Internet Explorer v5.0-v6.0
(i guess perior versions are vulnerable)
Vendor: Microsoft Corporation
Patch: N/A (Look at "Vendor Status" section)
Author: Arman Nayyeri, arman[at]4rman.com, http://www.4rman.com
Severity: Low
Description:
============
When a BMP file loaded into the Internet Explorer (for exmaple 'IMG' tag)
the internet explorer check the BMP image size written in BMP file, and then allocate the necessary memory to itself for placing bmp image into
the memory.
And it does not check the actual size of the file, so we can write a large
number in the bmp file and cause the IE to fill the memory up.
But we can't use a very large number because IE will check to see if there is
enough memory available, if not, it doesn't load it at all.
The max size of the bitmap is FFFFFFFF^2 (large number ;) ).
so the tiny (58 bytes) bitmap can take up to 51,539,607,528 GB memory.
Exploit:
========
The exploit that I provided is an html page with many IMG tags that loading
several BMP files with different sizes. So the memory fills up completely.
WARNING!!!!!
This DoS will cause serious system instability, please save your work
before loading this page, you may need to restart your computer!
Here is the page:
http://www.4rman.com/exploits/tinybmp.htm
please, take a look at my website too!
http://www.4rman.com
Exploit Tested On
=================
Internet Explorer 5.5
on
Microsoft Windows 2000 Server SP4
Microsoft Windows ME
Internet Explorer 6.0
on
Microsoft Windows XP
Microsoft Windows XP SP1
Microsoft Windows 2003 Enterprise
Vendor Status
=============
Microsoft notified about 3 month ago.
The bug will be fixed as part of the next possible service pack.
Special Thanks
==============
Special thanks to god.
Do I discover more vulnerabilities?
===================================
Maybe!(heh)
Disclaimer:
===========
Arman Nayyeri is not responsible for the misuse of the information
provided in this advisory. The opinions expressed are my own and not of
any company. In no event shall the author be liable for any damages
whatsoever arising out of or in connection with the use or spread of this
advisory. Any use of the information is at the user's own risk.
~~~~~~~~~~~~~~
and sorry for my bad english,
Arman Nayyeri
From
Iran
http://www.4rman.com