Vulnerabilities > CVE-2009-1217 - Off-by-one Error vulnerability in Microsoft Gdi+

047910
CVSS 4.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
network
microsoft
CWE-193
exploit available
NVD
Published: 2009-04-01
Updated: 2021-11-08

Summary

Off-by-one error in the GpFont::SetData function in gdiplus.dll in Microsoft GDI+ on Windows XP allows remote attackers to cause a denial of service (stack corruption and application termination) via a crafted EMF file that triggers an integer overflow, as demonstrated by voltage-exploit.emf, aka the "Microsoft GdiPlus EMF GpFont.SetData integer overflow."

Vulnerable Configurations

Part Description Count
Application
Microsoft
1
OS
Microsoft
1

Common Weakness Enumeration (CWE)

Exploit-Db

descriptionMicrosoft GdiPlus EMF GpFont.SetData Integer Overflow PoC. CVE-2009-1217. Dos exploit for windows platform
idEDB-ID:8281
last seen2016-02-01
modified2009-03-24
published2009-03-24
reporterBlack Security
sourcehttps://www.exploit-db.com/download/8281/
titleMicrosoft GdiPlus - EMF GpFont.SetData Integer Overflow PoC

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 34250 CVE(CAN) ID: CVE-2009-1217 Microsoft Windows是微软发布的非常流行的操作系统。 Windows的GDI+函数库（gdiplus.dll）的GPFont::SetData()函数中存在单字节溢出漏洞。如果用户受骗打开了 EmfPlusFontObject记录中设置有特制字体长度值的EMF图形的话，就可以触发这个溢出，导致使用该库的应用程序崩溃。以下是 Windows XP中的有漏洞代码段： #define FamilyNameMax 32 ... WCHAR familyName[FamilyNameMax]; ... length = fontData-&gt;Length; // this comes from the EMF file ... if (length &gt; FamilyNameMax) { length = FamilyNameMax; } ... // read in the familyName/data UnicodeStringCopyCount (familyName, (WCHAR *)dataBuffer, length); familyName[length]=0 Microsoft Windows XP SP3 Microsoft Windows XP SP2 Microsoft --------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： <a href=http://www.microsoft.com/technet/security/ target=_blank rel=external nofollow>http://www.microsoft.com/technet/security/</a>
idSSV:4997
last seen2017-11-19
modified2009-04-04
published2009-04-04
reporterRoot
sourcehttps://www.seebug.org/vuldb/ssvid-4997
titleMicrosoft Windows GDI+库GPFont::SetData()函数单字节溢出漏洞

References