SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   OS (Microsoft)  >   Windows Explorer Vendors:   Microsoft
Microsoft Windows XP Error in Explorer in Processing WAV Files Lets Remote Users Deny Service
SecurityTracker Alert ID:  1011880
SecurityTracker URL:  http://securitytracker.com/id/1011880
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Oct 22 2004
Impact:   Denial of service via network
Exploit Included:  Yes  

Description:   A vulnerability was reported in Microsoft Windows XP Explorer in the processing of WAV files. A remote user can create a WAV file that, when loaded by the target user, will consume all available CPU resources on the target system.

HexView reported that a specially crafted WAV file can trigger an infinite loop within the WAV file property handler, causing all available CPU resources to be consumed on the target system when the target user attempts to open the file via Windows Explorer.

A demonstration exploit WAV file header is provided:

00000000 52 49 46 46 42 D0 01 00 57 41 56 45 66 6D 74 20 RIFFB...WAVEfmt
00000010 FF FF FF FF 01 00 02 00 22 56 00 00 88 58 01 00 .........V...X..
00000020 04 00 10 00 00 00 66 61 63 74 04 00 00 00 04 74 ......fact.....t
00000030 00 00 64 61 74 61 10 D0 01 00 ..data....

THe report indicates that the "fmt " chunk is set to 0xFFFFFFFF (offset 0x10) instead of the usual length of 0x12 bytes.

The vendor was notified on October 20, 2004 without response.

The original advisory is available at:

http://www.hexview.com/docs/20041021-1.txt

Impact:   A remote user can cause all available CPU resources to be consumed on the target system.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.microsoft.com/ (Links to External Site)
Cause:   Input validation error, State error

Message History:   None.


 Source Message Contents

Subject:  [Full-Disclosure] [HV-LOW] Unsafe WAV header handling can cause DoS on Windows


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Unsafe WAV header handling can cause DoS on Windows

Classification:
===============
Level: [LOW]-med-high-crit
ID: HEXVIEW*2004*10*21*1
URL: http://www.hexview.com/docs/20041021-1.txt

Overview:
=========
A specially crafted WAV file can cause WAV file property handler
to consume all available CPU resources on Windows XP

Affected products:
==================
All tests were performed on the up-to-date version of Windows XP SP1
with all the latest patches and Windows Media Player 10 installed.

Cause and Effect:
=================
Insufficient data validation for WAV file headers causes explorer to enter
an endless loop where it infinitely reads the WAV file.

Demonstration:
==============
Below is an invalid WAV file header. Length of the "fmt " chunk is set to
0xFFFFFFFF (offset 0x10) The usual length of "fmt " chunk is 0x12 bytes.
Windows Explorer property handler thread will enter endless loop trying
to read the file.

00000000 52 49 46 46  42 D0 01 00  57 41 56 45  66 6D 74 20 RIFFB...WAVEfmt
00000010 FF FF FF FF  01 00 02 00  22 56 00 00  88 58 01 00 .........V...X..
00000020 04 00 10 00  00 00 66 61  63 74 04 00  00 00 04 74 ......fact.....t
00000030 00 00 64 61  74 61 10 D0  01 00                    ..data....

Vendor Status:
==============
Vendor has been notified on 2004-10-20. No response received.

About HexView:
==============
HexView contributes to online security-related lists for almost a
decade. The scope of our expertize spreads over Windows, Linux, Sun,
MacOS platforms, network applications, and embedded devices. The chances
are you read our advisories or disclosures. For more information visit
http://www.hexview.com

Distribution:
=============
This document may be freely distributed through any channels as long as
the contents are kept unmodified. Commercial use of the information in
the document is not allowed without written permission from HexView
signed by our pgp key.

HexView Disclosure Policy:
==========================
HexView notifies vendors that have publicly available contact e-mail 24
hours before disclosing any information to the public. If we are unable
to find vendor's e-mail address or if no reply is received within 24
hours, HexView will publish vulnerability notification including all
technical details unless the issue is rated as "critical". If vendor
does not reply within 72 hours, HexView may disclose all details for
critical vulnerabilities as well.

If vendor replies within the above mentioned time period, HexView will
announce the vulnerability, but will not disclose the details required
to reproduce it. HexView will also specify the date when full disclosure
containing all the details will be published. The time period between
announcement and full disclosure is 30 days unless there is an agreement
with vendor and appropriate justification for extension. If vendor
resolves the issue earlier than 30 days after announcement, HexView will
publish full disclosure as soon as the fix is available to the public.

HexView also reserves the right to publish any detail of any
vulnerability at any time.

Feedback and comments:
======================
Feedback and questions about this disclosure are welcome at
vtalk@hexview.com

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)

iD8DBQFBeElTDPV1+KQrDqQRAgIJAJ96resu9CmYbyLhuArc3cTYMYY30QCfYvzi
D2OuDef6rkqXo1DDqiFIsHI=
=AFK/
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC