Microsoft Internet Explorer BMP file memory DoS vulnerability

=============================================================

Title:     Microsoft Internet Explorer BMP file memory DoS vulnerability

Vuln Name: 58 bytes BMP vs 51,539,607,528 GB memory

Date:      Sunday, April 11, 2004

Software:  Internet Explorer v5.0-v6.0 

           (i guess perior versions are vulnerable)

Vendor:    Microsoft Corporation

Patch:     N/A (Look at "Vendor Status" section)

Author:    Arman Nayyeri, arman[at]4rman.com, http://www.4rman.com 

Severity:  Low





Description:

============

When a BMP file loaded into the Internet Explorer (for exmaple 'IMG' tag)

the internet explorer check the BMP image size written in BMP file, and then allocate the necessary memory to itself for placing bmp image into 

the memory.

And it does not check the actual size of the file, so we can write a large

number in the bmp file and cause the IE to fill the memory up.

But we can't use a very large number because IE will check to see if there is

enough memory available, if not, it doesn't load it at all.

The max size of the bitmap is FFFFFFFF^2 (large number ;) ).

so the tiny (58 bytes) bitmap can take up to 51,539,607,528 GB memory.



Exploit:

========

The exploit that I provided is an html page with many IMG tags that loading

several BMP files with different sizes. So the memory fills up completely.



WARNING!!!!!

This DoS will cause serious system instability, please save your work 

before loading this page, you may need to restart your computer!



Here is the page:

http://www.4rman.com/exploits/tinybmp.htm 



please, take a look at my website too! 

http://www.4rman.com 





Exploit Tested On

=================

Internet Explorer 5.5

			on

			Microsoft Windows 2000 Server SP4

			Microsoft Windows ME

Internet Explorer 6.0

			on

			Microsoft Windows XP

			Microsoft Windows XP SP1

			Microsoft Windows 2003 Enterprise



Vendor Status

=============

Microsoft notified about 3 month ago.

The bug will be fixed as part of the next possible service pack.



Special Thanks

==============

Special thanks to god.





Do I discover more vulnerabilities?

===================================

Maybe!(heh)





Disclaimer:

===========

Arman Nayyeri is not responsible for the misuse of the information 

provided in this advisory. The opinions expressed are my own and not of 

any company. In no event shall the author be liable for any damages 

whatsoever arising out of or in connection with the use or spread of this 

advisory. Any use of the information is at the user's own risk.



~~~~~~~~~~~~~~

and sorry for my bad english,

Arman Nayyeri

		From

			Iran

http://www.4rman.com