CVE-2008-1083
Microsoft GDI WMF Parsing Heap Overflow Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
3Exploited in Wild
-Decision
Descriptions
Heap-based buffer overflow in the CreateDIBPatternBrushPt function in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 2008 allows remote attackers to execute arbitrary code via an EMF or WMF image file with a malformed header that triggers an integer overflow, aka "GDI Heap Overflow Vulnerability."
Desbordamiento de búfer basado en memoria dinámica en la función CreateDIBPatternBrushPt en GDI en Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 y SP2, Vista y Server 2008 permite a atacantes remotos ejecutar código arbitrario a través de un archivo de imagen EMF o WMF con una cabezera mal formada que desencadena un desbordamiento de entero, vulnerabilidad también conocida como "GDI Heap Overflow Vulnerability".
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Windows. User interaction is required in that a user must open a malicious file or visit a malicious web page.
The specific flaw exists within the parsing of malformed WMF files. A vulnerability exists in the GDI funcion CreateDIBPatternBrushPt used when processing WMF files. Due to a mis-calculation of user data a heap chunk can be under-allocated and later used resulting in a heap overflow. Successful exploitation can result in system compromise under the credentials of the currently logged in user.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2008-02-28 CVE Reserved
- 2008-04-08 CVE Published
- 2008-10-02 First Exploit
- 2024-09-10 EPSS Updated
- 2024-10-15 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
- CWE-190: Integer Overflow or Wraparound
CAPEC
References (21)
| URL | Tag | Source |
|---|---|---|
| http://archives.neohapsis.com/archives/fulldisclosure/2008-04/0168.html | Broken Link | |
| http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=681 | Third Party Advisory | |
| http://www.kb.cert.org/vuls/id/632963 | Third Party Advisory |
|
| http://www.osvdb.org/44213 | Broken Link | |
| http://www.osvdb.org/44214 | Broken Link | |
| http://www.securityfocus.com/archive/1/490584/100/0/threaded | Mailing List | |
| http://www.securityfocus.com/bid/28571 | Third Party Advisory | |
| http://www.securityfocus.com/bid/30933 | Third Party Advisory | |
| http://www.securitytracker.com/id?1019798 | Third Party Advisory | |
| http://www.us-cert.gov/cas/techalerts/TA08-099A.html | Third Party Advisory | |
| http://www.vupen.com/english/advisories/2008/1145/references | Broken Link | |
| http://www.zerodayinitiative.com/advisories/ZDI-08-020 | Third Party Advisory |
|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/41471 | Vdb Entry | |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5441 | Signature |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/6330 | 2024-10-15 | |
| https://www.exploit-db.com/exploits/5442 | 2024-10-15 | |
| https://www.exploit-db.com/exploits/6656 | 2008-10-02 |
| URL | Date | SRC |
|---|---|---|
| http://secunia.com/advisories/29704 | 2023-12-07 |
| URL | Date | SRC |
|---|---|---|
| http://marc.info/?l=bugtraq&m=120845064910729&w=2 | 2023-12-07 | |
| http://support.microsoft.com/kb/948590 | 2023-12-07 | |
| https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-021 | 2023-12-07 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Microsoft Search vendor "Microsoft" | Windows 2000 Search vendor "Microsoft" for product "Windows 2000" | * | sp4 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Windows 2003 Server Search vendor "Microsoft" for product "Windows 2003 Server" | * | x64 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Windows 2003 Server Search vendor "Microsoft" for product "Windows 2003 Server" | * | sp1 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Windows 2003 Server Search vendor "Microsoft" for product "Windows 2003 Server" | * | sp1, itanium |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Windows 2003 Server Search vendor "Microsoft" for product "Windows 2003 Server" | * | sp2 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Windows 2003 Server Search vendor "Microsoft" for product "Windows 2003 Server" | * | sp2, itanium |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Windows 2003 Server Search vendor "Microsoft" for product "Windows 2003 Server" | * | sp2, x64 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Windows Server 2008 Search vendor "Microsoft" for product "Windows Server 2008" | - | itanium |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Windows Server 2008 Search vendor "Microsoft" for product "Windows Server 2008" | - | x64 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Windows Vista Search vendor "Microsoft" for product "Windows Vista" | * | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Windows Vista Search vendor "Microsoft" for product "Windows Vista" | * | x64 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Windows Vista Search vendor "Microsoft" for product "Windows Vista" | - | sp1 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Windows Xp Search vendor "Microsoft" for product "Windows Xp" | * | sp2 |
Affected
| ||||||