Outpost 個人防火牆 - Vulnerability in Microsoft Color Management Module Could Allow Remote Code Execution

Agnitum Security Advisories

ASA-02-0507-4: Vulnerability in Microsoft Color Management Module Could Allow Remote Code Execution

Severity rating: Critical
Date Published: July 12, 2005
Software Vendor: Microsoft
Affected Software: Color Management Module
Affected OS: Windows XP (incl. x64 Edition), Windows Me, Windows 98 (incl. SE), Windows Server 2003 (incl. x64 Edition), Windows 2000
Unaffected with:
Vulnerability class: Remote Code Execution
Status: Fixed

Vulnerability details:

Tech brief:

Due to errors in the way Color Management Module handles ICC profile format tag validation, arbitrary code can be executed on an affected system. The problem involves an unchecked ICC buffer.

An attacker could exploit the vulnerability by constructing a malicious image file that could potentially allow remote code execution if a user visited a malicious Web site or viewed a malicious e-mail message. An attacker who successfully exploited this vulnerability could take complete control of an affected system If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system.

An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Vendor reference information:

Vendor details pertaining to the problem are available here:
http://www.microsoft.com/technet/security/bulletin/MS05-036.mspx

General Mitigating Recommendations:

Install latest vendor patches available at http://windowsupdate.microsoft.com

How Outpost Firewall PRO and Outpost Office Firewall protect you:

The problem is OS-specific therefore no other standalone program is able to remedy it.

Disclaimer:

Information in the present advisory is believed to be accurate as to the time of publishing based on currently available information. Use of the information signifies acceptance for use in an AS IS condition. There are no warranties with regard to this information. Agnitum Ltd. doesn't accept any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.

關於Version 2 Limited

Version 2 Limited 是亞洲其中一間最有活力的IT公司，公司發展及代理各種不同的互聯網及IP-Based 網絡IT產品，當中包括通訊系統、保安、網絡及媒體產品。透過公司龐大的網絡、銷售點、分銷商及合作顆伴，Version 2 Limited 便可提供廣被市場讚賞的產品及服務。Version 2 Limited 客戶來自各行各業，包括全球1000大跨國企業、上市公司、公用機構、政府部門、無數成功的中小企及來自亞洲各城市的客戶。

如對產品有興趣，可瀏覽以下網址:
http://www.version-2.com/op
http://www.version-2.com/nod32op