Vulnerabilities > CVE-2017-0087 - Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Microsoft Windows 7, Windows Server 2008 and Windows Vista

047910
CVSS 9.3 - CRITICAL
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
microsoft
CWE-119
critical
nessus
exploit available
NVD
Published: 2017-03-17
Updated: 2017-08-16

Summary

Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to execute arbitrary code via a crafted web site, aka "Uniscribe Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0072, CVE-2017-0083, CVE-2017-0084, CVE-2017-0086, CVE-2017-0088, CVE-2017-0089, and CVE-2017-0090.

Vulnerable Configurations

Part Description Count
OS
Microsoft
4

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Exploit-Db

descriptionMicrosoft Windows - Uniscribe Font Processing Heap-Based Memory Corruption in 'USP10!MergeLigRecords' (MS17-011). CVE-2017-0087. Dos exploit for Windows plat...
fileexploits/windows/dos/41650.txt
idEDB-ID:41650
last seen2017-03-20
modified2017-03-20
platformwindows
port
published2017-03-20
reporterExploit-DB
sourcehttps://www.exploit-db.com/download/41650/
titleMicrosoft Windows - Uniscribe Font Processing Heap-Based Memory Corruption in 'USP10!MergeLigRecords' (MS17-011)
typedos

Msbulletin

bulletin_idMS17-011
bulletin_url
date2017-03-14T00:00:00
impactRemote Code Execution
knowledgebase_id4013076
knowledgebase_url
severityCritical
titleSecurity Update for Microsoft Uniscribe

Nessus

NASL familyWindows : Microsoft Bulletins
NASL idSMB_NT_MS17-011.NASL
descriptionThe remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities : - Multiple remote code execution vulnerabilities exist in Windows Uniscribe due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these to execute arbitrary code by convincing a user to view a specially crafted website or open a specially crafted document file. (CVE-2017-0072, CVE-2017-0083, CVE-2017-0084, CVE-2017-0086, CVE-2017-0087, CVE-2017-0088, CVE-2017-0089, CVE-2017-0090) - Multiple information disclosure vulnerabilities exist in Windows Uniscribe that allow an unauthenticated, remote attacker to gain access to sensitive information by convincing a user to view a specially crafted website or open a specially crafted document file. (CVE-2017-0085, CVE-2017-0091, CVE-2017-0092, CVE-2017-0111, CVE-2017-0112, CVE-2017-0113, CVE-2017-0114, CVE-2017-0115, CVE-2017-0116, CVE-2017-0117, CVE-2017-0118, CVE-2017-0119, CVE-2017-0120, CVE-2017-0121, CVE-2017-0122, CVE-2017-0123, CVE-2017-0124, CVE-2017-0125, CVE-2017-0126, CVE-2017-0127, CVE-2017-0128)
last seen2020-06-01
modified2020-06-02
plugin id97732
published2017-03-14
reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/97732
titleMS17-011: Security Update for Microsoft Uniscribe (4013076)
code
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(97732);
  script_version("1.14");
  script_cvs_date("Date: 2019/11/22");

  script_cve_id(
    "CVE-2017-0072",
    "CVE-2017-0083",
    "CVE-2017-0084",
    "CVE-2017-0085",
    "CVE-2017-0086",
    "CVE-2017-0087",
    "CVE-2017-0088",
    "CVE-2017-0089",
    "CVE-2017-0090",
    "CVE-2017-0091",
    "CVE-2017-0092",
    "CVE-2017-0111",
    "CVE-2017-0112",
    "CVE-2017-0113",
    "CVE-2017-0114",
    "CVE-2017-0115",
    "CVE-2017-0116",
    "CVE-2017-0117",
    "CVE-2017-0118",
    "CVE-2017-0119",
    "CVE-2017-0120",
    "CVE-2017-0121",
    "CVE-2017-0122",
    "CVE-2017-0123",
    "CVE-2017-0124",
    "CVE-2017-0125",
    "CVE-2017-0126",
    "CVE-2017-0127",
    "CVE-2017-0128"
  );
  script_bugtraq_id(
    96599,
    96603,
    96604,
    96605,
    96606,
    96607,
    96608,
    96610,
    96652,
    96657,
    96658,
    96659,
    96660,
    96661,
    96663,
    96665,
    96666,
    96667,
    96668,
    96669,
    96670,
    96672,
    96673,
    96674,
    96675,
    96676,
    96678,
    96679,
    96680
  );
  script_xref(name:"MSFT", value:"MS17-011");
  script_xref(name:"MSKB", value:"4012212");
  script_xref(name:"MSKB", value:"4012213");
  script_xref(name:"MSKB", value:"4012214");
  script_xref(name:"MSKB", value:"4012215");
  script_xref(name:"MSKB", value:"4012216");
  script_xref(name:"MSKB", value:"4012217");
  script_xref(name:"MSKB", value:"4012583");
  script_xref(name:"MSKB", value:"4012606");
  script_xref(name:"MSKB", value:"4013198");
  script_xref(name:"MSKB", value:"4013429");
  script_xref(name:"IAVA", value:"2017-A-0066");

  script_name(english:"MS17-011: Security Update for Microsoft Uniscribe (4013076)");
  script_summary(english:"Checks the version of Gdi32.dll and for rollup patches applied.");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The remote Windows host is missing a security update. It is,
therefore, affected by multiple vulnerabilities :

    - Multiple remote code execution vulnerabilities exist
      in Windows Uniscribe due to improper handling of
      objects in memory. An unauthenticated, remote attacker
      can exploit these to execute arbitrary code by
      convincing a user to view a specially crafted website
      or open a specially crafted document file.
      (CVE-2017-0072, CVE-2017-0083, CVE-2017-0084,
      CVE-2017-0086, CVE-2017-0087, CVE-2017-0088,
      CVE-2017-0089, CVE-2017-0090)

    - Multiple information disclosure vulnerabilities exist
      in Windows Uniscribe that allow an unauthenticated,
      remote attacker to gain access to sensitive
      information by convincing a user to view a specially
      crafted website or open a specially crafted document
      file. (CVE-2017-0085, CVE-2017-0091, CVE-2017-0092,
      CVE-2017-0111, CVE-2017-0112, CVE-2017-0113,
      CVE-2017-0114, CVE-2017-0115, CVE-2017-0116,
      CVE-2017-0117, CVE-2017-0118, CVE-2017-0119,
      CVE-2017-0120, CVE-2017-0121, CVE-2017-0122,
      CVE-2017-0123, CVE-2017-0124, CVE-2017-0125,
      CVE-2017-0126, CVE-2017-0127, CVE-2017-0128)");
  script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2017/ms17-011");
  script_set_attribute(attribute:"solution", value:
"Microsoft has released a set of patches for Windows Vista, 2008, 7,
2008 R2, 2012, 8.1, RT 8.1, 2012 R2, 10, and 2016.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/03/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/03/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/03/14");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows : Microsoft Bulletins");

  script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("smb_check_rollup.nasl", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
  script_require_keys("SMB/MS_Bulletin_Checks/Possible");
  script_require_ports(139, 445, "Host/patch_management_checks");

  exit(0);
}

include("audit.inc");
include("smb_hotfixes_fcheck.inc");
include("smb_hotfixes.inc");
include("smb_func.inc");
include("smb_reg_query.inc");
include("misc_func.inc");

get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");

bulletin = 'MS17-011';
kbs = make_list(
  "4012212", #  Security Only for Windows 7 SP1 and Server 2008 R2 SP1
  "4012213", # Security Only for Windows 8.1 and Windows 2012 R2
  "4012214", # Security Only for Windows Server 2012
  "4012215", # Security only for Windows 7 SP1 and Server 2008 R2 SP1
  "4012216", # Security only for Windows 8.1 and Windows Server 2012 R2
  "4012217", # Monthly Rollup for Windows Server 2012
  "4012583", # Vista / 2008
  "4012606", # Win 10
  "4013198", # Win 10 1511 (AKA 10586)
  "4013429"  # Win  10 1607 (AKA 14393)
);

if (get_kb_item("Host/patch_management_checks"))
  hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);

get_kb_item_or_exit("SMB/Registry/Enumerated");
get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);

if (hotfix_check_sp_range(vista:'2', win7:'1', win8:'0',  win81:'0', win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);

productname = get_kb_item_or_exit("SMB/ProductName", exit_code:1);
if ("Windows 8" >< productname && "8.1" >!< productname)
 audit(AUDIT_OS_SP_NOT_VULN);

if (hotfix_check_server_nano() == 1) audit(AUDIT_OS_NOT, "a currently supported OS (Windows Nano Server)");

share = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);
if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);

if (
  # Windows Vista / Windows Server 2008
  hotfix_is_vulnerable(os:"6.0", sp:2, file:"Gdi32.dll", version:"6.0.6002.24067", min_version:"6.0.6002.23000", dir:"\system32", bulletin:bulletin, kb:"4012583") ||
  hotfix_is_vulnerable(os:"6.0", sp:2, file:"Gdi32.dll", version:"6.0.6002.19743", min_version:"6.0.6002.18000", dir:"\system32", bulletin:bulletin, kb:"4012583") ||
  # Windows 7 / Server 2008 R2
  smb_check_rollup(os:"6.1", sp:1, rollup_date:"03_2017", bulletin:bulletin, rollup_kb_list:make_list(4012212, 4012215)) ||
  # Windows Server 2012
  smb_check_rollup(os:"6.2", sp:0, rollup_date:"03_2017", bulletin:bulletin, rollup_kb_list:make_list(4012214, 4012217)) ||
  # Windows 8.1 / Windows Server 2012 R2
  smb_check_rollup(os:"6.3", sp:0, rollup_date:"03_2017", bulletin:bulletin, rollup_kb_list:make_list(4012213, 4012216)) ||
  # Windows 10
  smb_check_rollup(os:"10", sp:0, os_build:"10240", rollup_date:"03_2017", bulletin:bulletin, rollup_kb_list:make_list(4012606)) ||
  # Windows 10 1511
  smb_check_rollup(os:"10", sp:0, os_build:"10586", rollup_date:"03_2017", bulletin:bulletin, rollup_kb_list:make_list(4013198)) ||
  # Windows 10 1607 / Server 2016
  smb_check_rollup(os:"10", sp:0, os_build:"14393", rollup_date:"03_2017", bulletin:bulletin, rollup_kb_list:make_list(4013429))
)
{
  set_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
  hotfix_security_hole();
  hotfix_check_fversion_end();
  exit(0);
}
else
{
  hotfix_check_fversion_end();
  audit(AUDIT_HOST_NOT, hotfix_get_audit_report());
}

Seebug

bulletinFamilyexploit
descriptionWe have encountered a crash in the Windows Uniscribe user-mode library, in the memmove() function called by USP10!MergeLigRecords, while trying to display text using a corrupted font file: ``` --- (4e0.6dc): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=00000001 ebx=00000036 ecx=000023af edx=00000003 esi=03624337 edi=0362436d eip=76e1026a esp=003cefd8 ebp=003cefe0 iopl=0 nv up ei pl nz ac pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010216 msvcrt!memmove+0x224: 76e1026a 8a4603 mov al,byte ptr [esi+3] ds:0023:0362433a=?? 0:000> kb # ChildEBP RetAddr Args to Child 00 003cefe0 774c772d 03621fc1 03621f8b 000023b0 msvcrt!memmove+0x224 01 003ceffc 774c75c3 03615fd0 036159d0 003cf098 USP10!MergeLigRecords+0x3d 02 003cf05c 774c7124 0000001a 035b3d88 035bffa8 USP10!LoadTTOArabicShapeTables+0x3f3 03 003cf070 774cc734 2e0105bd 035b3d88 035a6124 USP10!LoadArabicShapeTables+0xd4 04 003cf08c 774ba5a0 2e0105bd 036157d0 0000001a USP10!ArabicLoadTbl+0xd4 05 003cf0b4 774ba692 035a6124 2e0105bd 0000001a USP10!UpdateCache+0xb0 06 003cf0c8 774c15fd 2e0105bd 035a6000 774c16ab USP10!ScriptCheckCache+0x62 07 003cf0d4 774c16ab 00000001 00000001 00000000 USP10!GetShapeFunction+0xd 08 003cf10c 774c2bd4 00000001 00000004 003cf18c USP10!RenderItemNoFallback+0x5b 09 003cf138 774c2e62 00000001 00000004 003cf18c USP10!RenderItemWithFallback+0x104 0a 003cf15c 774c43f9 00000004 003cf18c 035a6124 USP10!RenderItem+0x22 0b 003cf1a0 774b7a04 000004a0 00000400 2e0105bd USP10!ScriptStringAnalyzeGlyphs+0x1e9 0c 003cf1b8 760a1736 2e0105bd 035a6040 0000000a USP10!ScriptStringAnalyse+0x284 0d 003cf204 760a18c1 2e0105bd 003cf688 0000000a LPK!LpkStringAnalyse+0xe5 0e 003cf300 760a17b4 2e0105bd 00000000 00000000 LPK!LpkCharsetDraw+0x332 0f 003cf334 77df56a9 2e0105bd 00000000 00000000 LPK!LpkDrawTextEx+0x40 10 003cf374 77df5a64 2e0105bd 00000048 00000000 USER32!DT_DrawStr+0x13c 11 003cf3c0 77df580f 2e0105bd 003cf688 003cf69c USER32!DT_GetLineBreak+0x78 12 003cf46c 77df5882 2e0105bd 00000000 0000000a USER32!DrawTextExWorker+0x250 13 003cf490 77df5b68 2e0105bd 003cf688 ffffffff USER32!DrawTextExW+0x1e 14 003cf4c4 000e6c3a 2e0105bd 003cf688 ffffffff USER32!DrawTextW+0x4d [...] 0:000> db poi(ebp+8) 03621fc1 c0 c0 c0 c0 c0 c0 c0 c0-c0 c0 c0 c0 c0 c0 c0 c0 ................ 03621fd1 c0 c0 c0 c0 c0 c0 c0 c0-c0 c0 c0 c0 c0 c0 c0 c0 ................ 03621fe1 c0 c0 c0 c0 c0 c0 c0 c0-c0 c0 c0 c0 c0 c0 c0 c0 ................ 03621ff1 c0 c0 c0 c0 c0 c0 c0 c0-c0 c0 c0 d0 d0 d0 d0 ?? ...............? 03622001 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ???????????????? 03622011 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ???????????????? 03622021 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ???????????????? 03622031 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ???????????????? 0:000> db poi(ebp+c) 03621f8b 00 b5 00 b7 00 b9 00 bb-00 bd 00 bf 00 c3 00 c5 ................ 03621f9b 00 c9 00 cb 00 c0 c0 c0-c0 c0 c0 c0 c0 c0 c0 c0 ................ 03621fab c0 c0 c0 c0 c0 c0 c0 c0-c0 c0 c0 c0 c0 c0 c0 c0 ................ 03621fbb c0 c0 c0 c0 c0 c0 c0 c0-c0 c0 c0 c0 c0 c0 c0 c0 ................ 03621fcb c0 c0 c0 c0 c0 c0 c0 c0-c0 c0 c0 c0 c0 c0 c0 c0 ................ 03621fdb c0 c0 c0 c0 c0 c0 c0 c0-c0 c0 c0 c0 c0 c0 c0 c0 ................ 03621feb c0 c0 c0 c0 c0 c0 c0 c0-c0 c0 c0 c0 c0 c0 c0 c0 ................ 03621ffb c0 d0 d0 d0 d0 ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? .....??????????? 0:000> dd esi 03624337 ???????? ???????? ???????? ???????? 03624347 ???????? ???????? ???????? ???????? 03624357 ???????? ???????? ???????? ???????? 03624367 ???????? ???????? ???????? ???????? 03624377 ???????? ???????? ???????? ???????? 03624387 ???????? ???????? ???????? ???????? 03624397 ???????? ???????? ???????? ???????? 036243a7 ???????? ???????? ???????? ???????? 0:000> dd edi 0362436d ???????? ???????? ???????? ???????? 0362437d ???????? ???????? ???????? ???????? 0362438d ???????? ???????? ???????? ???????? 0362439d ???????? ???????? ???????? ???????? 036243ad ???????? ???????? ???????? ???????? 036243bd ???????? ???????? ???????? ???????? 036243cd ???????? ???????? ???????? ???????? 036243dd ???????? ???????? ???????? ???????? --- ``` The issue reproduces on Windows 7. It is easiest to reproduce with PageHeap enabled, but it is also possible to observe a crash in a default system configuration. In order to reproduce the problem with the provided samples, it might be necessary to use a custom program which displays all of the font's glyphs at various point sizes. It's worth noting that the crash is almost identical to the one reported in Issue #1026 , which was supposedly fixed as CVE-2017-0087 in the MS17-011 bulletin. The number of times we have encountered this crash while fuzzing the patched version of USP10.DLL might suggest that the fix was incomplete (or alternatively, that there is a separate bug which causes a crash in the same code location). Attached are 6 proof of concept malformed font files which trigger the crash. ### PoC [poc.zip](https://bugs.chromium.org/p/project-zero/issues/attachment?aid=275873)
idSSV:96239
last seen2017-11-19
modified2017-06-27
published2017-06-27
reporterRoot
titleMicrosoft Windows Uniscribe Remote Code Execution Vulnerability(CVE-2017-0283)

References