PT-2008-3744 · Microsoft · Wmf+2

Published 2008-12-10 · Updated 2023-12-07 · CVE-2008-2249

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to the fixed version

Description: The issue is related to an integer overflow in GDI, allowing remote attackers to execute arbitrary code via a malformed header in a crafted WMF file. This triggers a buffer overflow. A remote code execution vulnerability exists in the way that GDI handles integer calculations, which could allow remote code execution if a user opens a specially crafted WMF image file. An attacker who successfully exploits this issue could take complete control of an affected system, then install programs, view, change, or delete data, or create new accounts.

Recommendations: For Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008, update to a version that includes the fix for the GDI integer overflow issue. As a temporary workaround, consider restricting access to WMF files until a patch is available. Avoid opening specially crafted WMF image files until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2008-2249

Affected Products

Gdi

Windows

Wmf

References · 9

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-071 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2249 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2249 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5984 · Note
• http://securitytracker.com/id?1021365 · Note
• http://us-cert.gov/cas/techalerts/TA08-344A.html · Note
• http://vupen.com/english/advisories/2008/3383 · Note
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=762 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-071 · Note