Microsoft GDIPlus.DLL JPEG Parsing Engine Buffer Overflow

[Nick D.]

Microsoft GDIPlus.DLL JPEG Parsing Engine Buffer Overflow
-----------------------------------------------------------------
Advisory: September 14, 2004
Reported: October 7, 2003

Systems affected based on testing:
Windows XP SP0,SP1,SP1a (Home & Pro)

Systems potentially affected based on Microsoft's DLL Help Database
(there may be others):

gdiplus.dll 5.2.3790.0
Windows Server 2003 Data Center
Windows Server 2003 Enterprise
Windows Server 2003 Standard
Windows Server 2003 Web Edition

gdiplus.dll 5.1.3100.0
Microsoft Visual Studio .NET (2003) Enterprise Architect

gdiplus.dll 5.1.3097.0
Microsoft Visual Studio .NET (2002) Enterprise Architect
Microsoft Visual Studio .NET (2002) Enterprise Developer
Microsoft Visual Studio .NET (2002) Professional
Microsoft Visual Studio .NET (2003) Enterprise Architect
Visual Basic .NET Standard 2002
Visual C# .NET Standard 2002
Visual C++ .NET Standard 2002
Windows XP Home 2002
Windows XP Professional 2002

gdiplus.dll 5.1.3079.3
Microsoft Visual Studio .NET (2002) Enterprise Architect
Visio 2002 Professional
Visio 2002 Standard


Description
------------------------

The JPEG parsing engine included in GDIPlus.dll contains an
exploitable buffer overflow. When a specially crafted JPEG image is
accessed through the Windows XP shell, a buffer overflow occurs
potentially allowing an attacker to run arbitrary code on the
affected system. Due to the pervasiveness of the affected dll there
may be other vulnerable attack vectors.


Technical
------------------------

JPEG Comment sections (COM) allow for the embedding of comment data
into a JPEG image. COM sections are marked beginning with 0xFFFE
followed by a 16 bit unsigned integer in network byte order giving
the total comment length + the 2 bytes for the length field; a
single JPEG COM section could therefore contain 65533 bytes of
invisible data (invisible in the sense that it's not rendered as
part of the image). Because the JPEG COM field length variable is 2
bytes wide, and itself is included in the length value, the minimum
value for this field is 2, this implies an empty comment. If the
comment length value is set to 1 or 0, a buffer overflow occurs
overwriting heap management structures.

The problem is GDIPlus normalizes the COM length prior to checking
it's value; a starting length of 0 becomes -2 after normalization
(0xFFFE unsigned), this value is converted to the 32 bit value
0xFFFFFFFE and is eventually passed on to memcpy which attempts to
copy ~4G bytes into heap memory.

eEye Digital Security analyzed the bug and found that heap
management structures are left in an inconsistent state with
execution eventually reaching heap unlink instructions within
RTLFreeHeap with EAX pointing to a pointer to data we control and we
have direct control of EDX.


Vendor Status
------------------------

Patch available MS04-028 (833987)
http://www.microsoft.com/technet/security/bulletin/ms04-028.mspx


Detection
------------------------

Detection could be accomplished by examining the JPEG image for the
following byte sequence:

0xFF 0xFE 0x00 0x00 or 0xFF 0xFE 0x00 0x01


Credits
------------------------
Nick DeBaggis - Discovery, analysis, and advisory.

Special thanks to eEye Digital Security www.eeye.com - Detailed
vulnerability analysis, initial and ongoing vendor contact.

Also thanks to Networks Unlimited - Early bug testing.


Related Links
------------------------
Solar Designer, Openwall Project
Netscape Browser JPEG Vulnerability July 2000
http://www.openwall.com/advisories/OW-002-netscape-jpeg.txt

[Polazzo Justin]

I am trying to distribute the patch via patch management software, the
problem is, Do I replace all incarnations if gdiplus.dll?=20

If I have a win2k box running IE6 sp1, I install the IE6 patch.=20

Fine, I can handle that, but what about my win2k boxes running AutoCAD
2004, Visio, IE6 and Dreamweaver? (all have gdiplus.dll, not sure which
ones need updating, but since the app versions of the dll are 5.1.3097.3
(.net) and 5.1.3097 (ACAD) and the ms replacement dll's are 5.1.3102 I
am assuming yes)

Is the package I should write is <script that looks for the DLL version
X and above, then replaces it with version Y> Would I use the SDK dll
for these other apps? Anyone know how to query for a dll version?

Suggestions responses, and posting this will be greatly appreciated!!

JP

Ps: ARRRgh!!

P.p.s: Am I missing the all in one patch? Is the GDI+ Detection Tool
available as download? Will the GDI detection tool search through non-ms
sw?

[sheep explode]

According to the information I have from MSFT. You do not need to
replace all instances of gdiplus.dll on a system and they actually
recommend that you not do this. some instances of gdipluss.dll are
not affected by this, It will depend on the application and they way
it uses gdiplus.dll.

According to the notes in the article for MS04-028 if you have Windows
XP or Windows 2003 and you have IE6 SP1 installed or Producer for
PowerPoint (all versions) you do not have to apply those two patches,
the app uses the gdiplus.dll that is patched with the OS patch. This
is not true of any other OS's to my knowledge. See the notes from the
KB article below

Re: Producer
"Note This update is not required if you are using these programs on
Windows XP. When these programs are installed on Windows XP or Windows
XP Service Pack 1 they use the operating system version of the
vulnerable component. If you are using these programs on Windows XP or
Windows XP Service Pack 1 make sure that you install the operating
system security update. If you are using these programs on Windows
2000 make sure that you install the update for these programs. These
programs are not supported on Windows Server 2003. However, if they
were installed on Windows Server 2003, they would also use the
operating system version of the vulnerable component. If you are using
these programs on Windows Server 2003 make sure that you install the
Windows Server 2003 security update."

Re: IE6 SP1
"Note This update is not required if you are using this program on
Windows XP or Windows Sever 2003. When this program is installed on
Windows XP, Windows XP Service Pack 1, or Windows Server 2003, it uses
the operating system version of the vulnerable component. If you use
this program on Windows XP, Windows XP Service Pack 1, or Windows
Server 2003, make sure that you install the operating system version
of the security update. If you use this program on other operating
systems, make sure that you install the update for this program.
Windows XP Service Pack 2 includes Internet Explorer 6 Service Pack 2
and is not vulnerable to this issue."

So in your instance you will need to apply the patch for IE6 SP1, and
Visio (depending on the version), Windows 2000 with SP3/4 is not
affected by this and does not have a patch.

If you really want to replace all instances of gdipluss.dll or get the
versions of any dll you could write a VBScript that uses WMI to do
that, it may have problems trying to replace the file if the dll is in
use. Your apps may not work either after this. If you do that I
would reccomend making a backup of them and then replacing them.

http://www.microsoft.com/technet/scriptcenter/default.mspx

Lastly, there is no all-in-one patch, MSFT said that this would create
a package that was too large for people to download. I am not sure
why they didn't do this, I don't think it has anything to do with the
size, but I can only speculate.

Here is a list of affected applications that is a little easier to
read than the KB article:
http://securityresponse.symantec.com/avcenter/security/Content/11173.html

Hope that helps.

-SE

On Wed, 15 Sep 2004 11:23:42 -0400, Polazzo Justin
<justin.polazzo@facilities.gatech.edu> wrote:
> I am trying to distribute the patch via patch management software, the
> problem is, Do I replace all incarnations if gdiplus.dll?
>
> If I have a win2k box running IE6 sp1, I install the IE6 patch. Visio, and it there is a patch for Dreamweaver and AutoCad apply those, they will be from the companies that build them, not MS.
>
> Fine, I can handle that, but what about my win2k boxes running AutoCAD
> 2004, Visio, IE6 and Dreamweaver? (all have gdiplus.dll, not sure which
> ones need updating, but since the app versions of the dll are 5.1.3097.3
> (.net) and 5.1.3097 (ACAD) and the ms replacement dll's are 5.1.3102 I
> am assuming yes)
>
> Is the package I should write is <script that looks for the DLL version
> X and above, then replaces it with version Y> Would I use the SDK dll
> for these other apps? Anyone know how to query for a dll version?
>
> Suggestions responses, and posting this will be greatly appreciated!!
>
> JP
>
> Ps: ARRRgh!!
>
> P.p.s: Am I missing the all in one patch? Is the GDI+ Detection Tool
> available as download? Will the GDI detection tool search through non-ms
> sw?
>

[Polazzo Justin]

Let me get this straight: It really doesn't matter if the version of
Frogger I run has the older dll, to exploit the flaw you would have to
get a user to view a malformed jpeg via the Frogger app which would call
the older dll and voila! Right?

Assuming that is correct; AutoCAD, while a big app on many systems,
probably does not have the kind of market saturation a worm writer is
looking for. This exploit could be used for directed attacks against
Dreamweaver users or CAD factories, but admins should concentrate on the
IE6 and Office patches as via HTTP or MUA is the most likely dispersion
of a jpeg exploit (IM as well, but I think trillian uses the system's
dll like a good program should).

Does anyone know why .net has its own dll for viewing jpeg's? Am I
misunderstanding the exploit/flaw/ or usage of this dll?

jp

-----Original Message-----
From: Gary Warner [mailto:gar@askgar.com]=20
Sent: Thursday, September 16, 2004 8:07 AM
To: Polazzo Justin; bugtraq@securityfocus.com;
birmingham-infragard@birmingham-infragard.org
Subject: Re: Microsoft GDIPlus.DLL JPEG Parsing Engine Buffer Overflow

On the Microsoft security briefing webcast yesterday they said that
GDIPLUS.DLL is distributed with many applications. Depending on how
those applications were built, simply replacing the DLL may break the
app. They recommend applying Microsoft patches, and contacting the
vendors of any apps associated with GDIPLUS.=20

The GDI+ detection tool ONLY DETECTS CURRENTLY SUPPORTED MICROSOFT
PRODUCTS.

They confirmed on the call that older versions ARE VULNERABLE but that
only CURRENT versions will be patched. Recommendation, of course,
update to current on every version.

There was special guidance for application developers dealing with
whether the app was built in Visual Studio as a "Managed Application" or
not. Rather than guess about that, I strongly recommend replaying the
webcast. There's a PDF of the slides available, and the Q&A had many
revealing deteails.

From www.microsoft.com/technet/security/
go to the Register for September Webcast link even though the meeting is
over, Register it will take you to a "View Recording" page which will
let you stream the Live Meeting Replay in Windows Media Format.
_-_
gar

[Angelidis, Fotis]

-----Original Message-----
From: Polazzo Justin [mailto:Justin.Polazzo@facilities.gatech.edu]
Sent: Wednesday, September 15, 2004 6:24 PM
To: Nick D.; bugtraq@securityfocus.com
Subject: RE: Microsoft GDIPlus.DLL JPEG Parsing Engine Buffer Overflow

>Ps: ARRRgh!!
>
>P.p.s: Am I missing the all in one patch? Is the GDI+ Detection Tool
>available as download? Will the GDI detection tool search through non-ms
>sw?

Actually the GDI+ Detection Tool comes before the actual update takes place
in Windows Update. If you visit windowsupdate.com and select the patch for
downloading, the tool is being downloaded first and if it finds any
vulnerable versions of the file, it downloads the updates respectively.

I cannot guarantee that it will search through non-ms software though,
however I'm not sure if the specific vulnerability affects non-ms products
in the first place. To the best of my knowledge it has to do with the JPEG
parsing engine in certain Microsoft products which are mentioned in the
advisory page :)

[Gary Warner]

On the Microsoft security briefing webcast yesterday they said that
GDIPLUS.DLL is distributed with many applications. Depending on how
those applications were built, simply replacing the DLL may break the
app. They recommend applying Microsoft patches, and contacting the
vendors of any apps associated with GDIPLUS.

The GDI+ detection tool ONLY DETECTS CURRENTLY SUPPORTED MICROSOFT PRODUCTS.

They confirmed on the call that older versions ARE VULNERABLE but that
only CURRENT versions will be patched. Recommendation, of course,
update to current on every version.

There was special guidance for application developers dealing with
whether the app was built in Visual Studio as a "Managed Application" or
not. Rather than guess about that, I strongly recommend replaying the
webcast. There's a PDF of the slides available, and the Q&A had many
revealing deteails.

From www.microsoft.com/technet/security/
go to the Register for September Webcast link
even though the meeting is over, Register
it will take you to a "View Recording" page which will let you stream
the Live Meeting Replay in Windows Media Format.
_-_
gar