Microsoft GDI+ JPEG Integer Underflow Vulnerability

Principles Of Secure Coding

JPEG Integer Underflow
Microsoft Security Bulletin MS04-028

Ashish Malik1731110017Information Security & Computer Forensic

Jpeg's themselves are not the problem however. Problem lies in the application that reads this information and displays the pictures on screen.

The exploit triggers an overflow in a common windows component called the GDI+ Jpeg Decoder.

Vulnerability specifically resides in gdiplus.dll.

These attack images are not technically a virus.

Different windows applications frequently distribute their own versions of GDI+.

Microsoft JPEG Vulnerability

Application fails to check the size of input data before copying it to memory.

Two types of buffer overflows :Stack Overflow

Heap Overflow

Stack and Heap are memory regions used by a process for storing various types of data.

Buffer Overflow

When a process makes a function call, the address of the next instruction, known as the return pointer, or RET is pushed onto stack.

Function call parameters are pushed on after RET.

Execution then jumps to the address of the called function.

Stack Overflow

Stack Overflow

Stack Overflow

Region of memory used by a process for accommodating data of sizes unknown at compile time.

Created within a process's virtual address space.

OS is responsible for heap management.Malloc() or HeapAlloc()

Standard heap contains an array called Free List, used to track the locations of free heap blocks.

Heap Overflow

Heap Overflow

Heap Overflow

Heap Overflow

Heap Overflow

Jpeg format defines a no. of headers.

The vulnerability described in MS04-028 lies in how GDI+ handles the comment header.

Each header segment begins with a 2-bytes ID.

Comment header consist of COM marker(0xFFFE)

GDI+ calculates the comment length by 2 from the value of length field.

GDI+ Jpeg Vulnerability

If length field specifies a comment length of 0 or 1, the GDI+ calculation results in a negative value. 1 2 = -1 0xFFFFFFFF 4GB - 1

It is interpreted as a positive integer in excess of 4 billion.

Unsigned integer of 32 bit is used to store the length of the comment data.


The GDI+ routine for copying the comment data to the heap is :

rep mov [edi], [esi]The ECX register is used as the counter.

GDI+ allows excessively large counter value.

GDI+ handles access violation by requesting additional heap space to continue with rep mov

HeapAlloc() returns pointers to heap locations, which contains the JPEG data.


The exploit takes advantage of this to overwrite the Unhandled Exception Filter Pointer.

Exploits may also use some form of win32_reverse shellcode from of Metasploit Project Shellcode Repository.


Thank You

Q & A

Click to edit the title text formatClick to edit Master title style

Click to edit the outline text formatSecond Outline LevelThird Outline LevelFourth Outline LevelFifth Outline LevelSixth Outline Level

Seventh Outline LevelClick to edit Master text styles
















Second level

Third level

Fourth level

Fifth level








Second level

Third level

Fourth level

Fifth level



Second level

Third level

Fourth level

Fifth level








Second level

Third level

Fourth level

Fifth level



Second level

Third level

Fourth level

Fifth level
































Second level

Third level

Fourth level

Fifth level







Click to edit the outline text formatSecond Outline LevelThird Outline LevelFourth Outline LevelFifth Outline LevelSixth Outline LevelSeventh Outline Level



Technology

Microsoft GDI+ JPEG Integer Underflow Vulnerability