Microsoft Windows GDI 'EMR_COLORMATCHTOTARGETW' Stack Overflow Vulnerability(MS08-021)

SEBUGID:SSD-20081014136
Published:2008-08-08
Vulnerable:
Research In Motion Blackberry Unite! 1.0.1 bundle 36
Research In Motion Blackberry Unite! 1.0.1
Research In Motion Blackberry Unite! 1.0
Research In Motion Blackberry Professional Software 4.1.4
Research In Motion Blackberry Enterprise Server 4.1.6
Research In Motion Blackberry Enterprise Server 4.1.5
Research In Motion Blackberry Enterprise Server 4.1.4
Research In Motion Blackberry Enterprise Server 4.1.3
Research In Motion Blackberry Enterprise Server 4.0.3
Nortel Networks CallPilot 703t
Nortel Networks CallPilot 702t
Nortel Networks CallPilot 201i
Nortel Networks CallPilot 200i
Nortel Networks CallPilot 1002rp
Microsoft Windows XP Tablet PC Edition SP2
Microsoft Windows XP Professional x64 Edition SP2
Microsoft Windows XP Professional SP2
Microsoft Windows XP Media Center Edition SP2
Microsoft Windows XP Home SP2
Microsoft Windows Vista Ultimate 64-bit edition SP1
Microsoft Windows Vista Ultimate 64-bit edition 0
Microsoft Windows Vista Home Premium 64-bit edition SP1
Microsoft Windows Vista Home Premium 64-bit edition 0
Microsoft Windows Vista Home Basic 64-bit edition SP1
Microsoft Windows Vista Home Basic 64-bit edition 0
Microsoft Windows Vista Enterprise 64-bit edition SP1
Microsoft Windows Vista Enterprise 64-bit edition 0
Microsoft Windows Vista Business 64-bit edition SP1
Microsoft Windows Vista Business 64-bit edition 0
Microsoft Windows Vista Ultimate SP1
Microsoft Windows Vista Ultimate
Microsoft Windows Vista SP1
Microsoft Windows Vista Home Premium SP1
Microsoft Windows Vista Home Premium
Microsoft Windows Vista Home Basic SP1
Microsoft Windows Vista Home Basic
Microsoft Windows Vista Enterprise SP1
Microsoft Windows Vista Enterprise
Microsoft Windows Vista Business SP1
Microsoft Windows Vista Business
Microsoft Windows Vista 0
Microsoft Windows Server 2008 Standard Edition 0
Microsoft Windows Server 2008 Enterprise Edition 0
Microsoft Windows Server 2008 Datacenter Edition 0
Microsoft Windows Server 2003 x64 SP2
Microsoft Windows Server 2003 x64 SP1
Microsoft Windows Server 2003 Web Edition SP2
Microsoft Windows Server 2003 Web Edition SP1
Microsoft Windows Server 2003 Standard Edition SP2
Microsoft Windows Server 2003 Standard Edition SP1
Microsoft Windows Server 2003 Itanium SP2
Microsoft Windows Server 2003 Itanium SP1
Microsoft Windows Server 2003 Enterprise x64 Edition SP2
Microsoft Windows Server 2003 Enterprise Edition Itanium SP1
Microsoft Windows Server 2003 Enterprise Edition SP1
Microsoft Windows Server 2003 Datacenter x64 Edition SP2
Microsoft Windows Server 2003 Datacenter Edition Itanium SP1
Microsoft Windows Server 2003 Datacenter Edition SP1
Microsoft Windows 2000 Server SP4
Microsoft Windows 2000 Professional SP4
Microsoft Windows 2000 Datacenter Server SP4
Microsoft Windows 2000 Advanced Server SP4
HP Storage Management Appliance 2.1
+ HP Storage Management Appliance III
+ HP Storage Management Appliance II
+ HP Storage Management Appliance I
3DM Software Disk Management Software SP2
3DM Software Disk Management Software SP1
Discription:
Microsoft Windows is prone to a stack-based overflow vulnerability that resides in the GDI graphics library and can be triggered by a malformed EMF image file.

A successful exploit of this vulnerability can allow a remote attacker to completely compromise the affected computer.
<*References
http://www.blackberry.com/btsc/dynamickc.do?externalId=KB15506&sliceId=SAL_Public&command=show&forward=nonthreadedKC&kcId=KB15506
http://www.microsoft.com/technet/security/Bulletin/MS08-021.mspx
http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=714206
*>
SEBUG Solution:
Microsoft Windows Server 2003 Datacenter Edition SP1

Microsoft Security Update for Windows Server 2003 (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=bee91d80-d49a -4d3d-82d6-d5aa63f54979


Microsoft Windows XP Media Center Edition SP2

Microsoft Security Update for Windows XP (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=c2763dd8-a03e -4a48-aa86-a7ec00250a7a


Microsoft Windows Server 2003 Itanium SP1

Microsoft Security Update for Windows Server 2003 for Itanium (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=7886a802-f2b5 -489c-b14b-631f4c4c0742


Microsoft Windows Server 2003 Enterprise Edition Itanium SP1

Microsoft Security Update for Windows Server 2003 for Itanium (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=7886a802-f2b5 -489c-b14b-631f4c4c0742


Microsoft Windows Server 2003 Datacenter x64 Edition SP2

Microsoft Security Update for Windows Server 2003 x64 Edition (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=e3dde449-e062 -4ce0-a9f4-433bff23e224


Microsoft Windows Vista Home Basic SP1

Microsoft Security Update for Windows Vista (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=9b51deb8-3873 -4146-977f-7e3d0840a4c5


Microsoft Windows XP Tablet PC Edition SP2

Microsoft Security Update for Windows XP (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=c2763dd8-a03e -4a48-aa86-a7ec00250a7a


Microsoft Windows Server 2003 Web Edition SP2

Microsoft Security Update for Windows Server 2003 (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=bee91d80-d49a -4d3d-82d6-d5aa63f54979


Microsoft Windows Vista Home Premium

Microsoft Security Update for Windows Vista (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=9b51deb8-3873 -4146-977f-7e3d0840a4c5


Microsoft Windows Server 2003 Standard Edition SP1

Microsoft Security Update for Windows Server 2003 (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=bee91d80-d49a -4d3d-82d6-d5aa63f54979


Microsoft Windows Server 2003 x64 SP1

Microsoft Security Update for Windows Server 2003 x64 Edition (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=e3dde449-e062 -4ce0-a9f4-433bff23e224


Microsoft Windows Vista Enterprise

Microsoft Security Update for Windows Vista (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=9b51deb8-3873 -4146-977f-7e3d0840a4c5


Microsoft Windows XP Professional x64 Edition SP2

Microsoft Security Update for Windows XP x64 Edition (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=166f2ab5-913c -47a9-86fe-b814797b751e


Microsoft Windows Vista 0

Microsoft Security Update for Windows Vista (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=9b51deb8-3873 -4146-977f-7e3d0840a4c5


Microsoft Windows Vista Business

Microsoft Security Update for Windows Vista (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=9b51deb8-3873 -4146-977f-7e3d0840a4c5


Microsoft Windows Server 2003 x64 SP2

Microsoft Security Update for Windows Server 2003 x64 Edition (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=e3dde449-e062 -4ce0-a9f4-433bff23e224


Microsoft Windows Vista Ultimate SP1

Microsoft Security Update for Windows Vista (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=9b51deb8-3873 -4146-977f-7e3d0840a4c5


Microsoft Windows Vista SP1

Microsoft Security Update for Windows Vista (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=9b51deb8-3873 -4146-977f-7e3d0840a4c5


Microsoft Windows Server 2003 Enterprise Edition SP1

Microsoft Security Update for Windows Server 2003 (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=bee91d80-d49a -4d3d-82d6-d5aa63f54979


Microsoft Windows Vista Home Basic

Microsoft Security Update for Windows Vista (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=9b51deb8-3873 -4146-977f-7e3d0840a4c5


Microsoft Windows Vista Business SP1

Microsoft Security Update for Windows Vista (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=9b51deb8-3873 -4146-977f-7e3d0840a4c5


Microsoft Windows 2000 Advanced Server SP4

Microsoft Security Update for Windows 2000 (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=caac000a-22b6 -48cb-aa00-1a0bfe886de2


Microsoft Windows Vista Ultimate

Microsoft Security Update for Windows Vista (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=9b51deb8-3873 -4146-977f-7e3d0840a4c5


Microsoft Windows Vista Home Premium SP1

Microsoft Security Update for Windows Vista (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=9b51deb8-3873 -4146-977f-7e3d0840a4c5


3DM Software Disk Management Software SP2

Microsoft Security Update for Windows Server 2003 (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=bee91d80-d49a -4d3d-82d6-d5aa63f54979


Microsoft Windows Server 2003 Standard Edition SP2

Microsoft Security Update for Windows Server 2003 (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=bee91d80-d49a -4d3d-82d6-d5aa63f54979


Microsoft Windows XP Home SP2

Microsoft Security Update for Windows XP (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=c2763dd8-a03e -4a48-aa86-a7ec00250a7a


3DM Software Disk Management Software SP1

Microsoft Security Update for Windows Server 2003 (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=bee91d80-d49a -4d3d-82d6-d5aa63f54979


Microsoft Windows 2000 Datacenter Server SP4

Microsoft Security Update for Windows 2000 (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=caac000a-22b6 -48cb-aa00-1a0bfe886de2


Microsoft Windows Server 2003 Itanium SP2

Microsoft Security Update for Windows Server 2003 for Itanium (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=7886a802-f2b5 -489c-b14b-631f4c4c0742


Microsoft Windows Server 2008 Standard Edition 0

Microsoft Security Update for Windows Server 2008 (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=006d5c47-53e6 -4ee1-932c-497611804938


Microsoft Windows Server 2003 Web Edition SP1

Microsoft Security Update for Windows Server 2003 (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=bee91d80-d49a -4d3d-82d6-d5aa63f54979


Microsoft Windows XP Professional SP2

Microsoft Security Update for Windows XP (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=c2763dd8-a03e -4a48-aa86-a7ec00250a7a


Microsoft Windows Server 2003 Datacenter Edition Itanium SP1

Microsoft Security Update for Windows Server 2003 for Itanium (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=7886a802-f2b5 -489c-b14b-631f4c4c0742


Microsoft Windows 2000 Server SP4

Microsoft Security Update for Windows 2000 (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=caac000a-22b6 -48cb-aa00-1a0bfe886de2


Microsoft Windows Server 2003 Enterprise x64 Edition SP2

Microsoft Security Update for Windows Server 2003 x64 Edition (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=e3dde449-e062 -4ce0-a9f4-433bff23e224


Microsoft Windows Server 2008 Datacenter Edition 0

Microsoft Security Update for Windows Server 2008 (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=006d5c47-53e6 -4ee1-932c-497611804938


Microsoft Windows 2000 Professional SP4

Microsoft Security Update for Windows 2000 (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=caac000a-22b6 -48cb-aa00-1a0bfe886de2


Microsoft Windows Server 2008 Enterprise Edition 0

Microsoft Security Update for Windows Server 2008 (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=006d5c47-53e6 -4ee1-932c-497611804938


Microsoft Windows Vista Enterprise SP1

Microsoft Security Update for Windows Vista (KB948590)
http://www.microsoft.com/downloads/details.aspx?familyid=9b51deb8-3873 -4146-977f-7e3d0840a4c5
Exploit:
[www.sebug.net]
The following procedures (methods) may contain something offensive，they are only for security researches and teaching , at your own risk!
http://www.sebug.net/bbs/thread-387-1-1.html
// Sebug.net [ 2008-10-04 ]