Vulnerabilities > CVE-2017-0061 - Information Exposure vulnerability in Microsoft Windows 7, Windows Server 2008 and Windows Vista
Attack vector
NETWORK Attack complexity
HIGH Privileges required
NONE Confidentiality impact
HIGH Integrity impact
NONE Availability impact
NONE Summary
The Color Management Module (ICM32.dll) memory handling functionality in Windows Vista SP2, Windows Server 2008 SP2 and R2, and Windows 7 SP1 allows remote attackers to bypass ASLR and execute code in combination with another vulnerability through a crafted website, aka "Microsoft Color Management Information Disclosure Vulnerability." This vulnerability is different from that described in CVE-2017-0063.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| OS | 4 |
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Subverting Environment Variable Values The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.
- Footprinting An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
- Exploiting Trust in Client (aka Make the Client Invisible) An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
- Browser Fingerprinting An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.
- Session Credential Falsification through Prediction This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.
Exploit-Db
| description | Microsoft Color Management Module 'icm32.dll' - 'icm32!Fill_ushort_ELUTs_from_lut16Tag' Out-of-Bounds Read (MS17-013). CVE-2017-0061. Dos exploit for Windows... |
| file | exploits/windows/dos/41657.txt |
| id | EDB-ID:41657 |
| last seen | 2017-03-20 |
| modified | 2017-03-20 |
| platform | windows |
| port | |
| published | 2017-03-20 |
| reporter | Exploit-DB |
| source | https://www.exploit-db.com/download/41657/ |
| title | Microsoft Color Management Module 'icm32.dll' - 'icm32!Fill_ushort_ELUTs_from_lut16Tag' Out-of-Bounds Read (MS17-013) |
| type | dos |
Msbulletin
| bulletin_id | MS17-013 |
| bulletin_url | |
| date | 2017-03-14T00:00:00 |
| impact | Remote Code Execution |
| knowledgebase_id | 4013075 |
| knowledgebase_url | |
| severity | Critical |
| title | Security Update for Microsoft Graphics Component |
Nessus
| NASL family | Windows : Microsoft Bulletins |
| NASL id | SMB_NT_MS17-013.NASL |
| description | The remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities : - Multiple elevation of privilege vulnerabilities exist in the Windows Graphics Device Interface (GDI) component due to improper handling of objects in memory. A local attacker can exploit these vulnerabilities, via a specially crafted application, to execute arbitrary code in kernel mode. (CVE-2017-0001, CVE-2017-0005, CVE-2017-0025, CVE-2017-0047) - Multiple remote code execution vulnerabilities exist in the Windows Graphics component due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these vulnerabilities, by convincing a user to visit a specially crafted web page or open a specially crafted document, to execute arbitrary code. (CVE-2017-0014, CVE-2017-0108) - An information disclosure vulnerability exists in the Windows Graphics Device Interface (GDI) component due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a specially crafted web page or open a specially crafted document, to disclose the contents of memory. (CVE-2017-0038) - Multiple information disclosure vulnerabilities exist in the Windows Graphics Device Interface (GDI) component due to improper handling of memory addresses. A local attacker can exploit these vulnerabilities, via a specially crafted application, to disclose sensitive information. (CVE-2017-0060, CVE-2017-0062, CVE-2017-0073) - Multiple information disclosure vulnerabilities exist in the Color Management Module (ICM32.dll) due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a specially crafted web page, to disclose sensitive information and bypass usermode Address Space Layout Randomization (ASLR). (CVE-2017-0061, CVE-2017-0063) |
| last seen | 2020-06-01 |
| modified | 2020-06-02 |
| plugin id | 97794 |
| published | 2017-03-17 |
| reporter | This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof. |
| source | https://www.tenable.com/plugins/nessus/97794 |
| title | MS17-013: Security Update for Microsoft Graphics Component (4013075) |
| code | |
Seebug
| bulletinFamily | exploit |
| description | We have encountered a crash in the Windows Color Management library (icm32.dll), in the icm32!Fill_ushort_ELUTs_from_lut16Tag function, while trying to display a TIFF image with a malformed embedded color profile: ``` (7c1c.93b0): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=00000001 ebx=0028f0dc ecx=0984f7c0 edx=00006ff0 esi=0980f800 edi=00000100 eip=6ac4f701 esp=0028ecc8 ebp=0028ecf4 iopl=0 nv up ei pl nz na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 icm32!Fill_ushort_ELUTs_from_lut16Tag+0xe4: 6ac4f701 0fb711 movzx edx,word ptr [ecx] ds:002b:0984f7c0=???? 0:000> kb ChildEBP RetAddr Args to Child 0028ecf4 6ac495bd 0028f0dc ff837f84 00004000 icm32!Fill_ushort_ELUTs_from_lut16Tag+0xe4 0028ed28 6ac4b117 0028f0dc 0028ef54 00002100 icm32!ExtractElutFromLut16+0xec 0028ed80 6ac4ca1d 0028f0dc 0028ef54 41324230 icm32!ExtractAll_MFT_LutsFromLut16+0x10a 0028edac 6ac4ccbf 0028f0dc 0028ef54 41324230 icm32!ExtractAll_MFT_Luts+0x8c 0028ee3c 6ac4d562 0028f0dc 0028ef54 00000000 icm32!ExtractAllLuts+0x257 0028f148 6ac4e947 0953ee58 09534ff0 061f7f70 icm32!CreateCombi+0x725 0028f2ec 6ac43c84 0953ee58 09534ff0 00000000 icm32!PrepareCombiLUTs+0x3a6 0028f498 6ac42dba 0953ee58 09534ff0 09534ff0 icm32!CMMConcatInitPrivate+0x23e 0028f4b4 6ac41630 0028f520 09534ff0 0028f5c4 icm32!CWConcatColorWorld4MS+0x42 0028f4e0 6ac41fce 0028f520 00180002 00000000 icm32!CMCreateMultiProfileTransformInternal+0x10b 0028f508 6c5ec8af 0028f5bc 00000002 0028f5c4 icm32!CMCreateMultiProfileTransform+0x20 0028f57c 6d2fd7c8 0028f5bc 00000002 0028f5c4 mscms!CreateMultiProfileTransform+0x22d 0028f5a0 6d2fb62c 0028f5bc 0028f5c4 00000000 WindowsCodecsExt!ICMModule::CreateMultiProfileTransform+0x27 0028f5d4 6d2f58cd 06277f90 40c8e2f0 40cf42f0 WindowsCodecsExt!CIcmColorTransform::CreateVectorTransform+0x6f 0028f640 69b25e74 09744f88 0970afac 0028f6b4 WindowsCodecsExt!CFormatConverterNChannel::Initialize+0x4b2 0028f6d8 6c8ea4be 0970cf90 0970afac 0028f710 WindowsCodecs!CFormatConverterResolver::Initialize+0x318 0028f724 6c8ec909 0010300c 00000000 07b67f68 gdiplus!GpWicDecoder::InitFormatConverter+0x7e 0028f760 6c8e9d72 00000000 07b55fd0 07b4df98 gdiplus!GpWicDecoder::DecodeFrame+0xb5 0028f774 6c8ddeb8 07b67f68 07b4df98 07b4df98 gdiplus!GpWicDecoder::GetImageInfo+0x29 0028f798 6c8de328 07b4df98 0000027f 07b4df38 gdiplus!GpDecodedImage::InternalGetImageInfo+0x3f 0028f7b8 6c830aee 07b55fd0 07b4df98 07b4bcd8 gdiplus!GpDecodedImage::GetImageInfo+0x18 0028f7cc 6c832cd3 0028f880 0028f7e8 6c83330d gdiplus!CopyOnWriteBitmap::CopyOnWriteBitmap+0x48 0028f7d8 6c83330d 0028f880 07b45f28 0028f7f8 gdiplus!CopyOnWriteBitmap::Create+0x1d 0028f7e8 6c8342aa 0028f880 07b43ff4 0028f81c gdiplus!GpBitmap::GpBitmap+0x2c 0028f7f8 6c803e8d 0028f880 085a1000 07b43ff0 gdiplus!GpImage::LoadImageW+0x69 0028f81c 003b171f 0028f880 07b43ff4 b2121dcf gdiplus!GdipLoadImageFromFile+0x74 [...] ``` The issue reproduces on Windows 7. It is easiest to reproduce with PageHeap enabled. In order to reproduce the problem with the provided samples, it might be necessary to use a custom program which displays images using GDI+, or any existing GDI+ client (such as Microsoft Office). Attached is a TIFF file which triggers the crash. |
| id | SSV:92862 |
| last seen | 2017-11-19 |
| modified | 2017-03-30 |
| published | 2017-03-30 |
| reporter | Root |
| title | Microsoft Color Management Module (icm32.dll) out-of-bounds read （CVE-2017-0061） |
References
- http://www.securityfocus.com/bid/96638
- http://www.securityfocus.com/bid/96638
- http://www.securitytracker.com/id/1038002
- http://www.securitytracker.com/id/1038002
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0061
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0061
- https://www.exploit-db.com/exploits/41657/
- https://www.exploit-db.com/exploits/41657/