Microsoft Windows Kernel ANI File Parsing Crash and DOS Vulnerability

[flashsky fangxing <flashsky@xxxxxxxxxx>]

 [Security Advisory]
    
    
Advisory: [AD_LAB-04005]Microsoft Windows Kernel ANI File Parsing Crash and Dos 
Vulnerability
Class: Design Error
DATE:12/20/2004
Remote: Yes
 
Vulnerable:
 Windows NT 
 Windows 2000 SP0
 Windows 2000 SP1
 Windows 2000 SP2
 Windows 2000 SP3
 Windows 2000 SP4
 Windows XP SP0
 Windows XP SP1
 Windows 2003
Not vulnerable:
 Windows XP SP2
Vendor:
 www.microsoft.com
 

I.DESCRIPTION: 
-------------
 
  Parsing a specially crafted ANI file causes the windows kernel to crash or 
stop to work
properly. An attacker can crash or freeze a target system if he sends a 
specially crafted 
ANI file within an HTML page or within an Email.
 
II.DETAILS:
----------
 
  ANI stands for Windows Animated Cursor and manages many images frames. Two 
vulnerabilities
exist in the Windows kernel when it parses ANI files.
 
  A first vulnerability exists because there is no proper check of the frame 
number set in the
ANI file header. If the Windows kernel try to parse the ANI file (offset 0x78 
in the ANI
file header) and the frame number is set to 0, the kernel will calculate a 
wrong address to
access and then crash.
 
  A second vulnerability exists because there is (again) no proper check of the 
rate number
set in the ANI file header. Setting this number to 0 causes the windows kernel 
to use up to
all of the system resources and then freeze.
 
    More details and POC at http://www.xfocus.net/flashsky/icoExp/index.html

III.CREDIT: 
----------
 
Flashsky(fangxing@xxxxxxxxxxxxxxxx;flashsky@xxxxxxxxxx) discovery this vuln:)
Vulnerability analysis and advisory by Flashsky and icbm.
Special thanks to "Fengshou" project members and all Venustech AD-Lab guys:P
 
V.DISCLAIMS:
-----------
 
The information in this bulletin is provided "AS IS" without warranty of any
kind. In no event shall we be liable for any damages whatsoever including 
direct,
indirect, incidental, consequential, loss of business profits or special 
damages. 
 
Copyright 1996-2004 VENUSTECH. All Rights Reserved. Terms of use.
 
VENUSTECH Security Lab 
VENUSTECH INFORMATION TECHNOLOGY CO.,LTD(http://www.venustech.com.cn)
 
          Security
Trusted  {Solution} Provider
          Service