| Notification Type: |
IBM Internet Security Systems Protection Advisory |
| Notification Date: |
Feb. 12, 2008 |
| Notification Version: |
1.0 |
| |
|
| Name: |
Microsoft OleLoadPicture Remote Code Execution Vulnerability |
Public disclosure/
In the wild date: |
Feb. 12, 2008 (vuln disclosure) |
| Aliases: |
MS08-008 |
| CVE: |
CVE-2007-0065 |
| Description: |
Microsoft Windows is vulnerable to a buffer overflow, caused by improper bounds checking when using OLE Automation that could lead to memory corruption. By creating a Web page containing specially crafted script requests, a remote attacker could overflow a buffer and execute arbitrary code on the system with privileges of the victim. |
| Discoverers: |
Ryan Smith and Alex Wheeler of IBM X-Force |
ISS Coverage |
| Product |
Content Version |
Proventia Network IDS
Proventia Network IPS
Proventia Network MFS
RealSecure Network
RealSecure Server Sensor |
XPU 27.070 |
Proventia Desktop
Proventia Server IPS |
2080 |
|
|
|
|
|
Detailed Description |
| Business Impact: |
Compromise of machines using affected versions of the oleaut32 library may lead to exposure of confidential information, loss of productivity, and further compromise. An attacker may need to entice a user to visit a web page, or open a specially-crafted file to trigger this vulnerability. Successful exploitation grants an attacker system-level privileges. |
| CVSS: |
Base Score: |
7.6 |
| |
Access Vector: |
Network |
| Access Complexity: |
High |
| Authentication: |
None |
| Confidentiality Impact: |
Complete |
| Integrity Impact: |
Complete |
| Availability Impact: |
Complete |
|
|
| Adjusted Temporal Score: |
5.6 |
| |
Exploitability: |
Unproven |
| Remediation Level: |
Official-Fix |
| Report Confidence: |
Confirmed |
| Affected Products: |
For a full list of affected versions, see references below. |
| Technical Description: |
During the processing of a specially-crafted image or OLE stream, a call to PictLoadMetaFileRaw can occur. Certain paths to this function allow an attacker to pass arguments.
An attacker could use certain parameters to supply an argument to PictLoadMetaFileRaw so that data would be written past the end of the allocated heap chunk, allowing code execution with the privileges of the process |
| Remediation: |
Patches are available for this issue. See References for details. |
|
References |
|
|
Revision History |
|
|
|
About IBM Internet Security Systems
IBM Internet Security Systems is the trusted security advisor to thousands of the world's leading businesses and governments, providing pre-emptive protection for networks, desktops and servers. An established leader in security since 1994, the IBM Proventia® integrated security platform is designed to automatically protect against both known and unknown threats, helping to keep networks up and running and shielding customers from online attacks before they impact business assets. IBM Internet Security Systems products and services are based on the proactive security intelligence of its X-Force® research and development team – the unequivocal world authority in vulnerability and threat research. The Internet Security Systems product line is also complemented by comprehensive Managed Security Services and Professional Security Services. For more information, visit the Internet Security Systems Web site at www.iss.net or call 800-776-2362.
|
