Vulnerabilities > CVE-2017-0038 - Information Exposure vulnerability in Microsoft products
Attack vector
LOCAL Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
NONE Availability impact
NONE Summary
gdi32.dll in Graphics Device Interface (GDI) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows remote attackers to obtain sensitive information from process heap memory via a crafted EMF file, as demonstrated by an EMR_SETDIBITSTODEVICE record with modified Device Independent Bitmap (DIB) dimensions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-3216, CVE-2016-3219, and/or CVE-2016-3220.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Subverting Environment Variable Values The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.
- Footprinting An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
- Exploiting Trust in Client (aka Make the Client Invisible) An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
- Browser Fingerprinting An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.
- Session Credential Falsification through Prediction This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.
Exploit-Db
| file | exploits/windows/dos/41363.txt |
| id | EDB-ID:41363 |
| last seen | 2018-11-30 |
| modified | 2017-02-15 |
| platform | windows |
| port | |
| published | 2017-02-15 |
| reporter | Exploit-DB |
| source | https://www.exploit-db.com/download/41363 |
| title | Microsoft Windows - 'gdi32.dll' EMR_SETDIBITSTODEVICE Heap Out-of-Bounds Reads / Memory Disclosure |
| type | dos |
Msbulletin
| bulletin_id | MS17-013 |
| bulletin_url | |
| date | 2017-03-14T00:00:00 |
| impact | Remote Code Execution |
| knowledgebase_id | 4013075 |
| knowledgebase_url | |
| severity | Critical |
| title | Security Update for Microsoft Graphics Component |
Nessus
| NASL family | Windows : Microsoft Bulletins |
| NASL id | SMB_NT_MS17-013.NASL |
| description | The remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities : - Multiple elevation of privilege vulnerabilities exist in the Windows Graphics Device Interface (GDI) component due to improper handling of objects in memory. A local attacker can exploit these vulnerabilities, via a specially crafted application, to execute arbitrary code in kernel mode. (CVE-2017-0001, CVE-2017-0005, CVE-2017-0025, CVE-2017-0047) - Multiple remote code execution vulnerabilities exist in the Windows Graphics component due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these vulnerabilities, by convincing a user to visit a specially crafted web page or open a specially crafted document, to execute arbitrary code. (CVE-2017-0014, CVE-2017-0108) - An information disclosure vulnerability exists in the Windows Graphics Device Interface (GDI) component due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a specially crafted web page or open a specially crafted document, to disclose the contents of memory. (CVE-2017-0038) - Multiple information disclosure vulnerabilities exist in the Windows Graphics Device Interface (GDI) component due to improper handling of memory addresses. A local attacker can exploit these vulnerabilities, via a specially crafted application, to disclose sensitive information. (CVE-2017-0060, CVE-2017-0062, CVE-2017-0073) - Multiple information disclosure vulnerabilities exist in the Color Management Module (ICM32.dll) due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a specially crafted web page, to disclose sensitive information and bypass usermode Address Space Layout Randomization (ASLR). (CVE-2017-0061, CVE-2017-0063) |
| last seen | 2020-06-01 |
| modified | 2020-06-02 |
| plugin id | 97794 |
| published | 2017-03-17 |
| reporter | This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof. |
| source | https://www.tenable.com/plugins/nessus/97794 |
| title | MS17-013: Security Update for Microsoft Graphics Component (4013075) |
| code | |
Seebug
| bulletinFamily | exploit |
| description | In [issue #757](<https://bugs.chromium.org/p/project-zero/issues/detail?id=757>), I described multiple bugs related to the handling of DIBs (Device Independent Bitmaps) embedded in EMF records, as implemented in the user-mode Windows GDI library (gdi32.dll). As a quick reminder, the DIB-embedding records follow a common scheme: they include four fields, spots denoting the offsets and lengths of the DIB header and the DIB data (named offBmiSrc, cbBmiSrc, offBitsSrc, cbBitsSrc). A correct implementation should verify that: 1) cbBmiSrc is within expected bounds, accounting for the DIB header, color palette etc. 2) the (offBmiSrc, offBmiSrc + cbBmiSrc) region resides within the record buffer's area. 3) cbBitsSrc is within expected bounds, and especially that it is larger or equal to the expected number of bitmap bytes. 4) the (offBitsSrc, offBitsSrc + cbBitsSrc) region resides within the record buffer's area. In the previous bug, I listed various combinations of missing checks in at least 10 different records: * EMR_ALPHABLEND * EMR_BITBLT * EMR_MASKBLT * EMR_PLGBLT * EMR_STRETCHBLT * EMR_TRANSPARENTBLT * EMR_SETDIBITSTODEVICE * EMR_STRETCHDIBITS * EMR_CREATEMONOBRUSH * EMR_EXTCREATEPEN As part of MS16-074, some of the bugs were indeed fixed, such as the EMR_STRETCHBLT record, which the original proof-of-concept image relied on. However, we've discovered that not all of the DIB-related problems are gone. For instance, the implementation of EMR_SETDIBITSTODEVICE (residing in the MRSETDIBITSTODEVICE::bPlay function) still doesn't enforce condition #3. As a result, it is possible to disclose uninitialized or out-of-bounds heap bytes via pixel colors, in Internet Explorer and other GDI clients which allow the extraction of displayed image data back to the attacker. The proof-of-concept file attached here consists of a single EMR_SETDIBITSTODEVICE record (excluding the header/EOF records), which originally contained a 1x1 bitmap. The dimensions of the DIB were then manually altered to 16x16, without adding any more actual image data. As a consequence, the 16x16/24bpp bitmap is now described by just 4 bytes, which is good for only a single pixel. The remaining 255 pixels are drawn based on junk heap data, which may include sensitive information, such as private user data or information about the virtual address space. I have confirmed that the vulnerability reproduces both locally in Internet Explorer, and remotely in the Office Online, via a . docx document containing the specially crafted EMF file. It is strongly advised to perform a careful audit of all EMF record handlers responsible for dealing with DIBs, in order to make sure that each of them correctly enforces all four condi Accessories: [poc. emf](<https://bugs.chromium.org/p/project-zero/issues/attachment?aid=259804>) |
| id | SSV:92717 |
| last seen | 2017-11-19 |
| modified | 2017-02-26 |
| published | 2017-02-26 |
| reporter | Root |
| title | Windows gdi32.dll heap-based out-of-bounds reads / memory disclosure (CVE-2017-0038) |
References
- https://bugs.chromium.org/p/project-zero/issues/detail?id=992
- https://0patch.blogspot.com/2017/02/0patching-0-day-windows-gdi32dll-memory.html
- http://www.securityfocus.com/bid/96023
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0038
- https://github.com/k0keoyo/CVE-2017-0038-EXP-C-JS
- http://www.securitytracker.com/id/1037845
- https://www.exploit-db.com/exploits/41363/