Signature Detail

HTTP: Microsoft Windows GDIplus WMF Integer Overflow

This signature detects attempts to exploit a known vulnerability in the Microsoft Windows WMF parser. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the user.

Extended Description

Microsoft GDI+ is prone to a remote code-execution vulnerability because the vector graphics link library improperly processes WMF image files. An attacker could exploit this issue to execute arbitrary code with the privileges of the currently logged-in user. Failed exploit attempts may crash applications that use the library.

Affected Products

• Microsoft excel_viewer
• Microsoft expression_web 2
• Microsoft expression_web
• Microsoft forefront_client_security 1.0
• Microsoft groove_2007 SP1
• Microsoft groove_2007
• Microsoft internet_explorer 6.0
• Microsoft internet_explorer 6.0 SP1
• Microsoft office_2003 SP1
• Microsoft office_2003 SP2
• Microsoft office_2003 SP3
• Microsoft office_2003
• Microsoft office_2007 SP1
• Microsoft office_2007 SP2
• Microsoft office_2007
• Microsoft office_compatibility_pack_2007 SP1
• Microsoft office_compatibility_pack_2007 SP2
• Microsoft office_compatibility_pack_2007
• Microsoft office_excel_viewer_2003 SP3
• Microsoft office_excel_viewer_2003
• Microsoft office_xp SP1
• Microsoft office_xp SP2
• Microsoft office_xp SP3
• Microsoft office_xp
• Microsoft platform_sdk_redistributable:_gdi+
• Microsoft powerpoint_viewer_2007 SP1
• Microsoft powerpoint_viewer_2007 SP2
• Microsoft powerpoint_viewer_2007
• Microsoft project_2002 SP1
• Microsoft project_2002
• Microsoft project_2002
• Microsoft report_viewer_2005 SP1
• Microsoft report_viewer_2008 SP1
• Microsoft report_viewer_2008
• Microsoft sql_server_2000_reporting_services SP2
• Microsoft sql_server_2005 SP1
• Microsoft sql_server_2005 SP2
• Microsoft sql_server_2005 SP3
• Microsoft sql_server_2005
• Microsoft sql_server_2005_express_edition SP1
• Microsoft sql_server_2005_express_edition SP2
• Microsoft sql_server_2005_express_edition
• Microsoft sql_server_2005_itanium_edition SP1
• Microsoft sql_server_2005_itanium_edition SP2
• Microsoft sql_server_2005_itanium_edition SP3
• Microsoft sql_server_2005_itanium_edition
• Microsoft sql_server_2005_x64_edition SP1
• Microsoft sql_server_2005_x64_edition SP2
• Microsoft sql_server_2005_x64_edition SP3
• Microsoft visio_2002 SP1
• Microsoft visio_2002 SP2
• Microsoft visio_2002
• Microsoft visio_2002_professional SP2
• Microsoft visio_viewer SP2
• Microsoft visual_foxpro 8.0
• Microsoft visual_foxpro 8.0 SP1
• Microsoft visual_foxpro 9.0 SP1
• Microsoft visual_foxpro 9.0 SP2
• Microsoft visual_studio_2005 SP1
• Microsoft visual_studio_2005
• Microsoft visual_studio_2005_professional_edition
• Microsoft visual_studio_2005_standard_edition
• Microsoft visual_studio_2005_team_edition
• Microsoft visual_studio_2005_team_edition_for_architects
• Microsoft visual_studio_2005_team_edition_for_developers
• Microsoft visual_studio_2005_team_edition_for_testers
• Microsoft visual_studio_2008 SP1
• Microsoft visual_studio_2008
• Microsoft visual_studio_.net_2003 SP1
• Microsoft visual_studio_.net_2003
• Microsoft visual_studio_.net_2003
• Microsoft windows_xp
• Microsoft windows_xp_embedded SP1
• Microsoft windows_xp_embedded SP2
• Microsoft windows_xp_embedded SP3
• Microsoft windows_xp_embedded
• Microsoft windows_xp_gold
• Microsoft windows_xp_home SP1
• Microsoft windows_xp_home SP2
• Microsoft windows_xp_home SP3
• Microsoft windows_xp_home
• Microsoft windows_xp_media_center_edition SP1
• Microsoft windows_xp_media_center_edition SP2
• Microsoft windows_xp_media_center_edition SP3
• Microsoft windows_xp_media_center_edition
• Microsoft windows_xp_professional SP1
• Microsoft windows_xp_professional SP2
• Microsoft windows_xp_professional SP3
• Microsoft windows_xp_professional
• Microsoft windows_xp_tablet_pc_edition SP1
• Microsoft windows_xp_tablet_pc_edition SP2
• Microsoft windows_xp_tablet_pc_edition SP3
• Microsoft windows_xp_tablet_pc_edition
• Microsoft word_viewer
• Microsoft word_viewer_2003 SP3
• Microsoft word_viewer_2003
• Microsoft works 8.5
• Nortel_networks callpilot 1002Rp
• Nortel_networks callpilot 200I
• Nortel_networks callpilot 201I
• Nortel_networks callpilot 702T
• Nortel_networks callpilot 703T
• Nortel_networks contact_center_administration_ccma 6.0
• Nortel_networks contact_center_administration_ccma 7.0
• Nortel_networks contact_center_express
• Nortel_networks contact_center_ncc
• Nortel_networks contact_center-tapi_server
• Nortel_networks media_processing_svr_1000_rel 3.0
• Nortel_networks media_processing_svr_500_rel 3.0
• Nortel_networks multimedia_comm_mas
• Nortel_networks self-service-ccss7
• Nortel_networks self-service_ccxml
• Nortel_networks self-service_media_processing_server
• Nortel_networks self-service_mps_100
• Nortel_networks self-service_mps_1000
• Nortel_networks self-service_mps_500
• Nortel_networks self-service_peri_application
• Nortel_networks self-service_peri_workstation
• Nortel_networks self-service_speech_server
• Nortel_networks self_service_voicexml
• Nortel_networks self-service_wvads
• Nortel_networks symposium_agent

References

• BugTraq: 36619
• CVE: CVE-2009-2500