Windows XP explorer.exe heap overflow.

Vulnerability in XP explorer.exe image loading
----------------------------------------------

Systems affected:
Current XP - others not tested.

Degree:
Arbitrary code execution.

Summary
-------
A malformed .emf (Enhanced Metafile, a graphics format) file can cause an exploitable heap overflow in (or near) shimgvw.dll.

Details
-------
The image preview code that explorer uses has an exploitable buffer overflow.

An .emf file with a "total size" field set to less than the header size will causes explorer.exe to crash in the heap routines - in classic heap overflow style that should be exploitable a la the RPC exploits.

There are two overflows here:

1. A buffer is allocated with the size indicated in the header (no validity checks), then the header is copied into it - if the size is less than the header size, that's one overflow.

2. They then proceed to read the rest of the file to a length of (size-headersize), which allows for an integer overflow causing the rest of the file to be appended to the already blown buffer.

Exploit
-------
To exploit this flaw (in explorer), simply place a malformed (invalid "size" field) .emf file
in any directory, open explorer to that path, and view as Thumbnails. Bang. In it's simplest
form it's a DOS - it affects all explorer windows, including File Open dialogs for many programs.

Alternatively, without viewing as a Thumbnail, open the picture preview window for the .emf file. (It's the default double-click action). Using this trigger causes a different crash point, which may not be exploitable, but I wouldn't rule it out.

Additional notes
----------------
It may be worth checking out similar issues in .wmf files, as they are similar.


- Jellytop, 2004

"If a man will begin with certainties, he shall end in doubts; but if he will be content to
begin with doubts he shall end in certainties."

[Michael Wojcik]

Yep. I suggested that on Vuln-Dev nearly four years ago [1], but I never
pursued it, and this is the first time since then that I've seen it come up.

In Outlook 2002 (aka Outlook XP, aka Outlook 10) and later, you can disable
the automatic display of any kind of non-text content by forcing Outlook to
render all email as plain text. This is a huge improvement over normal
Outlook behavior; besides making Outlook much less dangerous, it spares you
annoying markup of all kinds.

Create the Registry key

HKCU\Software\Microsoft\Office\10.0\Outlook\Option s\Mail\READASPLAIN

as a DWORD and set it to 1. Presto - no more HTML, no more RTF, no more
pictures.

1. http://www.securityfocus.com/archive/82/50050

--
Michael Wojcik
Principal Software Systems Developer, Micro Focus


> -----Original Message-----
> From: Chris Calabrese [mailto:chris_calabrese@yahoo.com]
> Sent: Monday, February 23, 2004 4:31 PM
> To: sunglasses@bay-watch.com; bugtraq@securityfocus.com
> Subject: Re: Windows XP explorer.exe heap overflow.
>
>
> This could actually be much worse since it looks like
> Internet Explorer
> and Outlook will happily display WMF files with no questions asked.
>
> Has anyone crafted a test WMF file we can use to check whether this
> could be exploited via an email worm through Outlook?
>
> On 2/20/2004 1:45 PM, sunglasses@bay-watch.com wrote:
> >
> >Vulnerability in XP explorer.exe image loading
> >
> >----------------------------------------------
> >
> >
> >
> >Systems affected:
> >
> > Current XP - others not tested.
> >
> >
> >
> >Degree:
> >
> > Arbitrary code execution.
> >
> >
> >
> >Summary
> >
> >-------
> >
> >A malformed .emf (Enhanced Metafile, a graphics format) file
> can cause
> an exploitable heap overflow in (or near) shimgvw.dll.
> >
> >
> >
> >Details
> >
> >-------
> >
> >The image preview code that explorer uses has an exploitable buffer
> overflow.
> >
> >
> >
> >An .emf file with a "total size" field set to less than the header
> size will causes explorer.exe to crash in the heap routines - in
> classic heap overflow style that should be exploitable a la the RPC
> exploits.
> >
> >
> >
> >There are two overflows here:
> >
> >
> >
> >1. A buffer is allocated with the size indicated in the header (no
> validity checks), then the header is copied into it - if the size is
> less than the header size, that's one overflow.
> >
> >
> >
> >2. They then proceed to read the rest of the file to a length of
> (size-headersize), which allows for an integer overflow causing the
> rest of the file to be appended to the already blown buffer.
> >
> >
> >
> >Exploit
> >
> >-------
> >
> >To exploit this flaw (in explorer), simply place a malformed (invalid
> "size" field) .emf file
> >
> >in any directory, open explorer to that path, and view as Thumbnails.
> Bang. In it's simplest
> >
> >form it's a DOS - it affects all explorer windows, including
> File Open
> dialogs for many programs.
> >
> >
> >
> >Alternatively, without viewing as a Thumbnail, open the picture
> preview window for the .emf file. (It's the default double-click
> action). Using this trigger causes a different crash point, which may
> not be exploitable, but I wouldn't rule it out.
> >
> >
> >
> >Additional notes
> >
> >----------------
> >
> >It may be worth checking out similar issues in .wmf files,
> as they are
> similar.
> >
> >
> >
> >
> >
> >- Jellytop, 2004
> >
> >
> >
> >"If a man will begin with certainties, he shall end in doubts; but if
> he will be content to
> >
> >begin with doubts he shall end in certainties."
> >
>
>
> __________________________________
> Do you Yahoo!?
> Yahoo! Mail SpamGuard - Read only the mail you want.
> http://antispam.yahoo.com/tools
>
> __________________________________________________ ____________
> __________
> This e-mail has been scanned for viruses by MCI's Internet
> Managed Scanning Services - powered by MessageLabs. For
> further information visit http://www.mci.com
> __________________________________________________ ____________
> __________
>

[Chris Calabrese]

This could actually be much worse since it looks like Internet Explorer
and Outlook will happily display WMF files with no questions asked.

Has anyone crafted a test WMF file we can use to check whether this
could be exploited via an email worm through Outlook?

On 2/20/2004 1:45 PM, sunglasses@bay-watch.com wrote:
>
>Vulnerability in XP explorer.exe image loading
>
>----------------------------------------------
>
>
>
>Systems affected:
>
> Current XP - others not tested.
>
>
>
>Degree:
>
> Arbitrary code execution.
>
>
>
>Summary
>
>-------
>
>A malformed .emf (Enhanced Metafile, a graphics format) file can cause
an exploitable heap overflow in (or near) shimgvw.dll.
>
>
>
>Details
>
>-------
>
>The image preview code that explorer uses has an exploitable buffer
overflow.
>
>
>
>An .emf file with a "total size" field set to less than the header
size will causes explorer.exe to crash in the heap routines - in
classic heap overflow style that should be exploitable a la the RPC
exploits.
>
>
>
>There are two overflows here:
>
>
>
>1. A buffer is allocated with the size indicated in the header (no
validity checks), then the header is copied into it - if the size is
less than the header size, that's one overflow.
>
>
>
>2. They then proceed to read the rest of the file to a length of
(size-headersize), which allows for an integer overflow causing the
rest of the file to be appended to the already blown buffer.
>
>
>
>Exploit
>
>-------
>
>To exploit this flaw (in explorer), simply place a malformed (invalid
"size" field) .emf file
>
>in any directory, open explorer to that path, and view as Thumbnails.
Bang. In it's simplest
>
>form it's a DOS - it affects all explorer windows, including File Open
dialogs for many programs.
>
>
>
>Alternatively, without viewing as a Thumbnail, open the picture
preview window for the .emf file. (It's the default double-click
action). Using this trigger causes a different crash point, which may
not be exploitable, but I wouldn't rule it out.
>
>
>
>Additional notes
>
>----------------
>
>It may be worth checking out similar issues in .wmf files, as they are
similar.
>
>
>
>
>
>- Jellytop, 2004
>
>
>
>"If a man will begin with certainties, he shall end in doubts; but if
he will be content to
>
>begin with doubts he shall end in certainties."
>


__________________________________
Do you Yahoo!?
Yahoo! Mail SpamGuard - Read only the mail you want.
http://antispam.yahoo.com/tools

[Eli K.]

I have tried to verify this issue with a malformed EMF file. Either I didn't
understand something or the vulnerability doesn't exist.

Here's what I did:

I took a sample EMF file and modified it's Size field (offset 0030h) to some
smaller value such as 0020h. The reported header size (offset 04h)
was 0000006Ch. I've experimented with the values a little but to no avail.

Windows XP seems to be immune to this. I didn't see any point on trying
a different OS (such as Win2K).

Maybe the poster to the list can provide some details or a malformed
EMF file so we could verify the issue ?

Eli

On Friday 20 February 2004 20:45, sunglasses@bay-watch.com wrote:
> Vulnerability in XP explorer.exe image loading
> ----------------------------------------------
>
> Systems affected:
> Current XP - others not tested.
>
> Degree:
> Arbitrary code execution.
>
> Summary
> -------
> A malformed .emf (Enhanced Metafile, a graphics format) file can cause an
> exploitable heap overflow in (or near) shimgvw.dll.
>
> Details
> -------
> The image preview code that explorer uses has an exploitable buffer
> overflow.
>
> An .emf file with a "total size" field set to less than the header size
> will causes explorer.exe to crash in the heap routines - in classic heap
> overflow style that should be exploitable a la the RPC exploits.
>
> There are two overflows here:
>
> 1. A buffer is allocated with the size indicated in the header (no validity
> checks), then the header is copied into it - if the size is less than the
> header size, that's one overflow.
>
> 2. They then proceed to read the rest of the file to a length of
> (size-headersize), which allows for an integer overflow causing the rest of
> the file to be appended to the already blown buffer.
>
> Exploit
> -------
> To exploit this flaw (in explorer), simply place a malformed (invalid
> "size" field) .emf file in any directory, open explorer to that path, and
> view as Thumbnails. Bang. In it's simplest form it's a DOS - it affects all
> explorer windows, including File Open dialogs for many programs.
>
> Alternatively, without viewing as a Thumbnail, open the picture preview
> window for the .emf file. (It's the default double-click action). Using
> this trigger causes a different crash point, which may not be exploitable,
> but I wouldn't rule it out.
>
> Additional notes
> ----------------
> It may be worth checking out similar issues in .wmf files, as they are
> similar.
>
>
> - Jellytop, 2004
>
> "If a man will begin with certainties, he shall end in doubts; but if he
> will be content to begin with doubts he shall end in certainties."

[Tim]

This is very similar (though perhaps different) than the DoS found by
Marc Ruef: http://seclists.org/lists/fulldisclo.../Sep/0047.html
and later analyzed:
http://seclists.org/lists/fulldisclo.../Sep/0078.html
http://seclists.org/lists/fulldisclo.../Sep/0080.html

This older find boiled down to an overflow in parsing gif images that,
AFAIK, M$ refused to patch, or decided to patch silently (Ask Marc, he
would know for sure). It also would cause explorer.exe to crash
intermittently when the gif was previewed. I am curious to know if
these are related or not. Any comments on that Jellytop? (I have a
sample of the gif if you want to test.)

tim


On Fri, Feb 20, 2004 at 06:45:39PM -0000, sunglasses@bay-watch.com wrote:
>
>
> Vulnerability in XP explorer.exe image loading
> ----------------------------------------------
>
> Systems affected:
> Current XP - others not tested.
>
> Degree:
> Arbitrary code execution.
>
> Summary
> -------
> A malformed .emf (Enhanced Metafile, a graphics format) file can cause
> an exploitable heap overflow in (or near) shimgvw.dll.
>
> Details
> -------
> The image preview code that explorer uses has an exploitable buffer overflow.
>
> An .emf file with a "total size" field set to less than the header
> size will causes explorer.exe to crash in the heap routines - in classic
> heap overflow style that should be exploitable a la the RPC exploits.
>
> There are two overflows here:
>
> 1. A buffer is allocated with the size indicated in the header (no
> validity checks), then the header is copied into it - if the size is
> less than the header size, that's one overflow.
>
> 2. They then proceed to read the rest of the file to a length of
> (size-headersize), which allows for an integer overflow causing the rest
> of the file to be appended to the already blown buffer.
>
> Exploit
> -------
> To exploit this flaw (in explorer), simply place a malformed (invalid
> "size" field) .emf file
> in any directory, open explorer to that path, and view as Thumbnails.
> Bang. In it's simplest
> form it's a DOS - it affects all explorer windows, including File Open
> dialogs for many programs.
>
> Alternatively, without viewing as a Thumbnail, open the picture
> preview window for the .emf file. (It's the default double-click
> action). Using this trigger causes a different crash point, which may
> not be exploitable, but I wouldn't rule it out.
>
> Additional notes
> ----------------
> It may be worth checking out similar issues in .wmf files, as they are
> similar.
>
>
> - Jellytop, 2004
>
> "If a man will begin with certainties, he shall end in doubts; but if
> he will be content to
> begin with doubts he shall end in certainties."

[Larry Seltzer]

The sample someone sent around that caused the 100% CPU hogging had the Size field set
to 0000h. Try that. Perhaps it's not just a matter of the value being lower, but below
some small threshold.

Larry Seltzer
eWEEK.com Security Center Editor
http://security.eweek.com/
larryseltzer@ziffdavis.com

-----Original Message-----
From: Eli K. [mailto:elik@beyondsecurity.com]
Sent: Tuesday, February 24, 2004 5:36 AM
To: sunglasses@bay-watch.com; bugtraq@securityfocus.com
Subject: Re: Windows XP explorer.exe heap overflow.


I have tried to verify this issue with a malformed EMF file. Either I didn't
understand something or the vulnerability doesn't exist.

Here's what I did:

I took a sample EMF file and modified it's Size field (offset 0030h) to some smaller
value such as 0020h. The reported header size (offset 04h)
was 0000006Ch. I've experimented with the values a little but to no avail.

Windows XP seems to be immune to this. I didn't see any point on trying a different OS
(such as Win2K).

Maybe the poster to the list can provide some details or a malformed EMF file so we
could verify the issue ?

Eli

On Friday 20 February 2004 20:45, sunglasses@bay-watch.com wrote:
> Vulnerability in XP explorer.exe image loading
> ----------------------------------------------
>
> Systems affected:
> Current XP - others not tested.
>
> Degree:
> Arbitrary code execution.
>
> Summary
> -------
> A malformed .emf (Enhanced Metafile, a graphics format) file can cause
> an exploitable heap overflow in (or near) shimgvw.dll.
>
> Details
> -------
> The image preview code that explorer uses has an exploitable buffer
> overflow.
>
> An .emf file with a "total size" field set to less than the header
> size will causes explorer.exe to crash in the heap routines - in
> classic heap overflow style that should be exploitable a la the RPC
> exploits.
>
> There are two overflows here:
>
> 1. A buffer is allocated with the size indicated in the header (no
> validity checks), then the header is copied into it - if the size is
> less than the header size, that's one overflow.
>
> 2. They then proceed to read the rest of the file to a length of
> (size-headersize), which allows for an integer overflow causing the
> rest of the file to be appended to the already blown buffer.
>
> Exploit
> -------
> To exploit this flaw (in explorer), simply place a malformed (invalid
> "size" field) .emf file in any directory, open explorer to that path,
> and view as Thumbnails. Bang. In it's simplest form it's a DOS - it
> affects all explorer windows, including File Open dialogs for many
> programs.
>
> Alternatively, without viewing as a Thumbnail, open the picture
> preview window for the .emf file. (It's the default double-click
> action). Using this trigger causes a different crash point, which may
> not be exploitable, but I wouldn't rule it out.
>
> Additional notes
> ----------------
> It may be worth checking out similar issues in .wmf files, as they are
> similar.
>
>
> - Jellytop, 2004
>
> "If a man will begin with certainties, he shall end in doubts; but if
> he will be content to begin with doubts he shall end in certainties."

[Eli Kara]

The author spoke of a heap-based overflow (which we know can lead to code
execution).

Although peaking the CPU at 100% shouldn't happen, it is still quite different
than an overflow

E

On Wednesday 25 February 2004 17:48, Larry Seltzer wrote:
> The sample someone sent around that caused the 100% CPU hogging had the
> Size field set to 0000h. Try that. Perhaps it's not just a matter of the
> value being lower, but below some small threshold.
>
> Larry Seltzer
> eWEEK.com Security Center Editor
> http://security.eweek.com/
> larryseltzer@ziffdavis.com
>
> -----Original Message-----
> From: Eli K. [mailto:elik@beyondsecurity.com]
> Sent: Tuesday, February 24, 2004 5:36 AM
> To: sunglasses@bay-watch.com; bugtraq@securityfocus.com
> Subject: Re: Windows XP explorer.exe heap overflow.
>
>
> I have tried to verify this issue with a malformed EMF file. Either I
> didn't understand something or the vulnerability doesn't exist.
>
> Here's what I did:
>
> I took a sample EMF file and modified it's Size field (offset 0030h) to
> some smaller value such as 0020h. The reported header size (offset 04h)
> was 0000006Ch. I've experimented with the values a little but to no avail.
>
> Windows XP seems to be immune to this. I didn't see any point on trying a
> different OS (such as Win2K).
>
> Maybe the poster to the list can provide some details or a malformed EMF
> file so we could verify the issue ?
>
> Eli
>
> On Friday 20 February 2004 20:45, sunglasses@bay-watch.com wrote:
> > Vulnerability in XP explorer.exe image loading
> > ----------------------------------------------
> >
> > Systems affected:
> > Current XP - others not tested.
> >
> > Degree:
> > Arbitrary code execution.
> >
> > Summary
> > -------
> > A malformed .emf (Enhanced Metafile, a graphics format) file can cause
> > an exploitable heap overflow in (or near) shimgvw.dll.
> >
> > Details
> > -------
> > The image preview code that explorer uses has an exploitable buffer
> > overflow.
> >
> > An .emf file with a "total size" field set to less than the header
> > size will causes explorer.exe to crash in the heap routines - in
> > classic heap overflow style that should be exploitable a la the RPC
> > exploits.
> >
> > There are two overflows here:
> >
> > 1. A buffer is allocated with the size indicated in the header (no
> > validity checks), then the header is copied into it - if the size is
> > less than the header size, that's one overflow.
> >
> > 2. They then proceed to read the rest of the file to a length of
> > (size-headersize), which allows for an integer overflow causing the
> > rest of the file to be appended to the already blown buffer.
> >
> > Exploit
> > -------
> > To exploit this flaw (in explorer), simply place a malformed (invalid
> > "size" field) .emf file in any directory, open explorer to that path,
> > and view as Thumbnails. Bang. In it's simplest form it's a DOS - it
> > affects all explorer windows, including File Open dialogs for many
> > programs.
> >
> > Alternatively, without viewing as a Thumbnail, open the picture
> > preview window for the .emf file. (It's the default double-click
> > action). Using this trigger causes a different crash point, which may
> > not be exploitable, but I wouldn't rule it out.
> >
> > Additional notes
> > ----------------
> > It may be worth checking out similar issues in .wmf files, as they are
> > similar.
> >
> >
> > - Jellytop, 2004
> >
> > "If a man will begin with certainties, he shall end in doubts; but if
> > he will be content to begin with doubts he shall end in certainties."

[Dragos Ruiu]

> > To exploit this flaw (in explorer), simply place a malformed (invalid
> > "size" field) .emf file in any directory, open explorer to that path,
> > and view as Thumbnails. Bang. In it's simplest form it's a DOS - it
> > affects all explorer windows, including File Open dialogs for many
> > programs.

The february 04 issue of MaximumPC lists the following registry key
to tweak to help speed up your system. Seems to me this might have
other benefits besides speed. :-)

Remove Image Preview by deleting this key:

HKEY_Classes_Root\SystemFileAssociations\Image\She llEx\ContextMenuHandlers\ShellImagePreview

cheers,
--dr

--
Top security experts. Cutting edge tools, techniques and information.
Vancouver, Canada April 21-23 2004 http://cansecwest.com
pgpkey http://dragos.com/ kyxpgp