Microsoft Windows Graphics Rendering Engine Buffer Overflow Vulnerability
Last Update Date:
28 Jan 2011
Release Date:
5 Jan 2011
4708
Views
RISK: Medium Risk
A vulnerability has been identified in Microsoft Windows, which could be exploited by attackers to take complete control of a vulnerable system. This issue is caused by a stack overflow error in the "CreateSizedDIBSECTION()" function within the "shimgvw.dll" module when parsing a malformed thumbnail image, which could be exploited by attackers to execute arbitrary code by tricking a user into opening or previewing a malformed Office file or browsing to a network share, UNC, or WebDAV location containing a specially crafted thumbnail image.
Impact
- Remote Code Execution
System / Technologies affected
- Microsoft Windows XP Service Pack 3
- Microsoft Windows XP Professional x64 Edition Service Pack 2
- Microsoft Windows Server 2003 Service Pack 2
- Microsoft Windows Server 2003 x64 Edition Service Pack 2
- Microsoft Windows Server 2003 SP2 (Itanium)
- Microsoft Windows Vista Service Pack 1
- Microsoft Windows Vista Service Pack 2
- Microsoft Windows Vista x64 Edition Service Pack 1
- Microsoft Windows Vista x64 Edition Service Pack 2
- Microsoft Windows Server 2008 (32-bit)
- Microsoft Windows Server 2008 (32-bit) Service Pack 2
- Microsoft Windows Server 2008 (x64)
- Microsoft Windows Server 2008 (x64) Service Pack 2
- Microsoft Windows Server 2008 (Itanium)
- Microsoft Windows Server 2008 (Itanium) Service Pack 2
Solutions
- Modify the Access Control List (ACL) on shimgvw.dll :
http://www.microsoft.com/technet/security/advisory/2490606.mspx
Vulnerability Identifier
Source
Related Link
Share with