SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (Web Browser)  >   Microsoft Internet Explorer (IE) Vendors:   Microsoft
Microsoft Internet Explorer Bitmap Memory Allocation Error Lets Remote Users Cause All Available Memory to Be Consumed
SecurityTracker Alert ID:  1009746
SecurityTracker URL:  http://securitytracker.com/id/1009746
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Apr 13 2004
Impact:   Denial of service via network
Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 5.5, 6.0
Description:   A denial of service vulnerability was reported in Microsoft Internet Explorer. A remote user can cause the target user's browser to consume an excessive amount of memory.

Arman Nayyeri reported that a remote user can create a specially crafted bitmap file that, when loaded by the target user, will cause a large amount of memory to be allocated. According to the report, the target user's Internet Explorer browser will allocate memory for the bitmap file based on the user-supplied image size in the bitmap file. A 58 byte bitmap can reportedly cause up to 51,539,607,528 bytes of memory to be allocated on the target user's system.

The vulnerability can reportedly be triggered via HTML that references an affected bitmap file.

A demonstration exploit is available at:

http://www.4rman.com/exploits/tinybmp.htm

Impact:   A remote user can cause a target user's system to consume all available memory.
Solution:   No solution was available at the time of this entry. The vendor reportedly plans to issue a fix as part of a subsequent Service Pack release.
Vendor URL:  www.microsoft.com/technet/security/ (Links to External Site)
Cause:   Input validation error, Resource error
Underlying OS:   Windows (Any)

Message History:   None.


 Source Message Contents

Date:  11 Apr 2004 06:07:30 -0000
Subject:  Microsoft Internet Explorer BMP file memory DoS vulnerability




Microsoft Internet Explorer BMP file memory DoS vulnerability
=============================================================
Title:     Microsoft Internet Explorer BMP file memory DoS vulnerability
Vuln Name: 58 bytes BMP vs 51,539,607,528 GB memory
Date:      Sunday, April 11, 2004
Software:  Internet Explorer v5.0-v6.0 
           (i guess perior versions are vulnerable)
Vendor:    Microsoft Corporation
Patch:     N/A (Look at "Vendor Status" section)
Author:    Arman Nayyeri, arman[at]4rman.com, http://www.4rman.com
Severity:  Low


Description:
============
When a BMP file loaded into the Internet Explorer (for exmaple 'IMG' tag)
the internet explorer check the BMP image size written in BMP file, and then allocate the necessary memory to itself for placing bmp
 image into 
the memory.
And it does not check the actual size of the file, so we can write a large
number in the bmp file and cause the IE to fill the memory up.
But we can't use a very large number because IE will check to see if there is
enough memory available, if not, it doesn't load it at all.
The max size of the bitmap is FFFFFFFF^2 (large number ;) ).
so the tiny (58 bytes) bitmap can take up to 51,539,607,528 GB memory.

Exploit:
========
The exploit that I provided is an html page with many IMG tags that loading
several BMP files with different sizes. So the memory fills up completely.

WARNING!!!!!
This DoS will cause serious system instability, please save your work 
before loading this page, you may need to restart your computer!

Here is the page:
http://www.4rman.com/exploits/tinybmp.htm

please, take a look at my website too! 
http://www.4rman.com


Exploit Tested On
=================
Internet Explorer 5.5
			on
			Microsoft Windows 2000 Server SP4
			Microsoft Windows ME
Internet Explorer 6.0
			on
			Microsoft Windows XP
			Microsoft Windows XP SP1
			Microsoft Windows 2003 Enterprise

Vendor Status
=============
Microsoft notified about 3 month ago.
The bug will be fixed as part of the next possible service pack.

Special Thanks
==============
Special thanks to god.


Do I discover more vulnerabilities?
===================================
Maybe!(heh)


Disclaimer:
===========
Arman Nayyeri is not responsible for the misuse of the information 
provided in this advisory. The opinions expressed are my own and not of 
any company. In no event shall the author be liable for any damages 
whatsoever arising out of or in connection with the use or spread of this 
advisory. Any use of the information is at the user's own risk.

~~~~~~~~~~~~~~
and sorry for my bad english,
Arman Nayyeri
		From
			Iran
http://www.4rman.com

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC