Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
Microsoft Internet Explorer Bitmap Memory Allocation Error Lets Remote Users Cause All Available Memory to Be Consumed
|
|
SecurityTracker Alert ID: 1009746 |
|
SecurityTracker URL: http://securitytracker.com/id/1009746
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Apr 13 2004
|
Impact:
Denial of service via network
|
Vendor Confirmed: Yes Exploit Included: Yes
|
Version(s): 5.5, 6.0
|
Description:
A denial of service vulnerability was reported in Microsoft Internet Explorer. A remote user can cause the target user's browser to consume an excessive amount of memory.
Arman Nayyeri reported that a remote user can create a specially crafted bitmap file that, when loaded by the target user, will cause a large amount of memory to be allocated. According to the report, the target user's Internet Explorer browser will allocate memory for the bitmap file based on the user-supplied image size in the bitmap file. A 58 byte bitmap can reportedly cause up to 51,539,607,528 bytes of memory to be allocated on the target user's system.
The vulnerability can reportedly be triggered via HTML that references an affected bitmap file.
A demonstration exploit is available at:
http://www.4rman.com/exploits/tinybmp.htm
|
Impact:
A remote user can cause a target user's system to consume all available memory.
|
Solution:
No solution was available at the time of this entry. The vendor reportedly plans to issue a fix as part of a subsequent Service Pack release.
|
Vendor URL: www.microsoft.com/technet/security/ (Links to External Site)
|
Cause:
Input validation error, Resource error
|
Underlying OS:
Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: 11 Apr 2004 06:07:30 -0000
Subject: Microsoft Internet Explorer BMP file memory DoS vulnerability
|
Microsoft Internet Explorer BMP file memory DoS vulnerability
=============================================================
Title: Microsoft Internet Explorer BMP file memory DoS vulnerability
Vuln Name: 58 bytes BMP vs 51,539,607,528 GB memory
Date: Sunday, April 11, 2004
Software: Internet Explorer v5.0-v6.0
(i guess perior versions are vulnerable)
Vendor: Microsoft Corporation
Patch: N/A (Look at "Vendor Status" section)
Author: Arman Nayyeri, arman[at]4rman.com, http://www.4rman.com
Severity: Low
Description:
============
When a BMP file loaded into the Internet Explorer (for exmaple 'IMG' tag)
the internet explorer check the BMP image size written in BMP file, and then allocate the necessary memory to itself for placing bmp
image into
the memory.
And it does not check the actual size of the file, so we can write a large
number in the bmp file and cause the IE to fill the memory up.
But we can't use a very large number because IE will check to see if there is
enough memory available, if not, it doesn't load it at all.
The max size of the bitmap is FFFFFFFF^2 (large number ;) ).
so the tiny (58 bytes) bitmap can take up to 51,539,607,528 GB memory.
Exploit:
========
The exploit that I provided is an html page with many IMG tags that loading
several BMP files with different sizes. So the memory fills up completely.
WARNING!!!!!
This DoS will cause serious system instability, please save your work
before loading this page, you may need to restart your computer!
Here is the page:
http://www.4rman.com/exploits/tinybmp.htm
please, take a look at my website too!
http://www.4rman.com
Exploit Tested On
=================
Internet Explorer 5.5
on
Microsoft Windows 2000 Server SP4
Microsoft Windows ME
Internet Explorer 6.0
on
Microsoft Windows XP
Microsoft Windows XP SP1
Microsoft Windows 2003 Enterprise
Vendor Status
=============
Microsoft notified about 3 month ago.
The bug will be fixed as part of the next possible service pack.
Special Thanks
==============
Special thanks to god.
Do I discover more vulnerabilities?
===================================
Maybe!(heh)
Disclaimer:
===========
Arman Nayyeri is not responsible for the misuse of the information
provided in this advisory. The opinions expressed are my own and not of
any company. In no event shall the author be liable for any damages
whatsoever arising out of or in connection with the use or spread of this
advisory. Any use of the information is at the user's own risk.
~~~~~~~~~~~~~~
and sorry for my bad english,
Arman Nayyeri
From
Iran
http://www.4rman.com
|
|
Go to the Top of This SecurityTracker Archive Page
|
