U.S. Flag Official website of the Department of Homeland Security

Note: This page is part of the us-cert.gov archive.This document is part of the US-CERT website archive. These documents are no longer updated and may contain outdated information. Links may also no longer function. Please contact info@us-cert.gov if you have any questions about the US-CERT website archive.

TLP:WHITE

Alert (TA05-012A)

Multiple Vulnerabilities in Microsoft Windows Icon and Cursor Processing

Original release date: January 12, 2005

Systems Affected

Microsoft Windows Operating Systems excluding Microsoft Windows XP SP2

Overview

Microsoft Windows contains multiple vulnerabilities in the way that it handles cursor and icon files. A remote attacker could execute arbitrary code or cause a denial-of-service condition.

Description

Microsoft Security Bulletin MS05-002 describes a number of vulnerabilities in the way that Windows handles icons, cursors, animated cursors, and bitmaps. Further details are available in the following vulnerability notes:

VU#625856 - Microsoft Windows LoadImage API vulnerable to integer overflow

The Microsoft Windows LoadImage routine is vulnerable to an integer overflow that may allow a remote attacker to execute arbitrary code on a vulnerable system.
(CAN-2004-1049)

VU#697136 - Microsoft Windows kernel vulnerable to denial-of-service condition via animated cursor (.ani) rate number

A vulnerability exists in the way the Microsoft Windows kernel processes animated cursor (.ani) files with a rate number set to zero. Exploitation of this vulnerability may allow a remote attacker to cause a denial-of-service condition.
(CAN-2004-1305)

VU#177584 - Microsoft Windows kernel vulnerable to denial-of-service condition via animated cursor (.ani) frame number

A vulnerability exists in the way the Microsoft Windows kernel processes animated cursor (.ani) files with a frame number set to zero. Exploitation of this vulnerability may allow a remote attacker to cause a denial-of-service condition.
(CAN-2004-1305)

Note that exploits for these vulnerabilities are publicly available.

Impact

If a remote attacker can persuade a user to access a specially crafted bitmap image, icon, or cursor file, the attacker may be able to execute arbitrary code on that user's system, with their privileges. Potentially, any operation that displays an image could trigger exploitation; for instance, browsing the file system, reading HTML email, or browsing websites.

Solution

Install an Update

Install the update as described in Microsoft Security Bulletin MS05-002. Please also note that this update is also available via Windows Update and Automatic Updates.

Appendix A. References


These vulnerabilities were reported by Flashsky Fangxing and eEye Digital Security.

Feedback can be directed to the author: Jeffrey Gennari.

Revision History

  • Jan 12, 2005: Initial release
    Jan 12, 2005: Updated revision release date and copyright date

    Last updated

This product is provided subject to this Notification and this Privacy & Use policy.

Was this document helpful?  Yes  |  Somewhat  |  No

Back to Top