Check Point Advisories

Preemptive Protection against Microsoft Windows WMF File Handling Denial of Service Vulnerability

Check Point Reference:	CPAI-2006-096
Date Published:	13 Aug 2006
Severity:	Medium
Last Updated:	Tuesday 15 May, 2007
Source:	FRSIRT/ADV-2006-3180
Industry Reference:	CVE-2006-4071
Protection Provided by:
Who is Vulnerable?	Microsoft Windows 2000 SP4 Microsoft Windows XP SP1 Microsoft Windows XP SP2 Microsoft Windows XP Professional x64 Edition Microsoft Windows Server 2003 Microsoft Windows Server 2003 SP1 Microsoft Windows Server 2003 (Itanium) Microsoft Windows Server 2003 SP1 (Itanium) Microsoft Windows Server 2003 x64 Edition
Vulnerability Description	Several Microsoft Windows operating systems fail to process malformed WMF files. A remote attacker can trigger this flaw to deny service from legitimate users. By convincing a user to visit a specially crafted Web page or to open a malformed image file, an attacker could cause applications on the user's system to crash.
Update/Patch Avaliable	Check Point is not aware of any official patch for this issue
Vulnerability Details	This vulnerability is due to an error in the GDI Client DLL library (gdi32.dll) when processing malformed WMF files. A remote attacker can crash an application using the vulnerable library by convincing a user to view a specially crafted WMF image file or a maliciously crafted Web page.