Date: Sun, 1 Apr 2007 21:19:39 -0500 (CDT)
From: Gadi Evron <ge@linuxbox.org.>
To: [email protected], [email protected]Subject: More information on ZERT patch for ANI 0day
Message-ID: <Pine.LNX.4.21.0704012117261.14352-100000@linuxbox.org.>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-1.7.5 (linuxbox.org [127.0.0.1]); Sun, 01 Apr 2007 21:19:40 -0500 (CDT)
X-Virus-Scanned: antivirus-gw at tyumen.ru
Hi, more information about the patch released April 1st can be found here:
http://zert.isotf.org/
Including:
1. Technical information.
2. Why this patch was released when eeye already released a third party
patch.
The newly discovered zero-day vulnerability in the parsing of animated
cursors is very similar to the one previously discovered by eEye that was
patched by Microsoft in MS05-002. Basically an "anih" chunk in an animated
cursor RIFF file is read into a stack buffer of a fixed size (36
bytes) but the actual memory copy operation uses the length field provided
inside the "anih" chunk.giving an attacker an easy route to overflow the
stack and gain control of the execution of the process.
With the MS05-002 patch, Microsoft added a check for the length of the
chunk before copying it to the buffer. However, they neglected to audit
the rest of the code for any other instances of the vulnerable copy
routine. As it turns out, if there are two "anih" chunks in the file, the
second chunk will be handled by a separate piece of code which Microsoft
did not fix. This is what the authors of the zero-day discovered.
Although eEye has released a third-party patch that will prevent the
latest exploit from working, it doesn't fix the flawed copy routine. It
simply requires that any cursors loaded must reside within the Windows
directory (typically C:\WINDOWS\ or C:\WINNT\). This approach should
successfully mitigate most "drive-by's," but might be bypassed by an
attacker with access to this directory.
For this reason, ZERT is releasing a patch which addresses the core of the
vulnerability, by ensuring that no more than 36 bytes of an "anih" chunk
will be copied to the stack buffer, thus eliminating all potential exploit
paths while maintaining compatibility with well-formatted animated cursor
files.
Gadi.
