Unsolved
This post is more than 5 years old
3 Apprentice
•
15.2K Posts
0
4211
UNPATCHED - Microsoft Windows win32k.sys Driver "CreateDIBPalette()" Buffer Overflow
The following has been copied/pasted from http://secunia.com/advisories/40870/
Description
Arkon has discovered a [less critical] vulnerability in Microsoft Windows, which can be exploited by malicious people to gain escalated privileges.
The vulnerability is caused due to a boundary error in win32k.sys within the "CreateDIBPalette()" function when copying colour values into a buffer allocated with a fixed size when creating the DIB palette. This can be exploited via the "GetClipboardData()" API to cause a buffer overflow by specifying a large number of colours (greater than 256) via the "biClrUsed" field in a BITMAPINFOHEADER structure.
Successful exploitation may allow execution of arbitrary code with kernel privileges.
The vulnerability is confirmed in fully patched versions of Windows XP SP3, Windows Server 2003 R2 Enterprise SP2, Windows Vista Business SP1, Windows 7, and Windows Server 2008 SP2.
Solution
Grant only access to trusted users.
Provided and/or discovered by
Arkon
Original Advisory
Arkon:
http://www.ragestorm.net/blogs/?p=255
Tom.Getty
5 Posts
0
November 8th, 2010 18:00
Have you solved the problem? It's long time, Could you give more details?
Bugbatter
20.5K Posts
0
November 8th, 2010 21:00
Yes, I've solved the problem. There’s no doubt about it. It was the myth of fingerprints. I’ve seen them all and man, they’re all the same.