Microsoft Security Bulletin MS08-046 - Critical

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in your situation:

• In a Web-based attack scenario, an attacker could host a Web site that contains a Web page that is used to exploit this vulnerability. In addition, compromised Web sites and Web sites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit this vulnerability. In all cases, however, an attacker would have no way to force users to visit these Web sites. Instead, an attacker would have to convince users to visit the Web site, typically by getting them to click a link in an e-mail message or Instant Messenger message that takes users to the attacker's Web site.
• An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Workaround refers to a setting or configuration change that does not correct the underlying vulnerability but would help block known attack vectors before you apply the update. Microsoft has tested the following workarounds and states in the discussion whether a workaround reduces functionality:

• Turn off metafile processing by modifying the registry
  Customers who have applied MS07-017 can disable metafile processing by modifying the registry. This setting will help protect the affected system from attempts to exploit this vulnerability.

  To modify the key, follow these steps:

  Note Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. For information about how to edit the registry, view the "Changing Keys And Values" Help topic in Registry Editor (Regedit.exe) or view the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe.

  1. Click Start, click Run, type Regedit in the Open box, and then click OK.
  2. Locate and then click the following registry subkey:
     
     HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
  3. On the Edit menu, point to New, and then click DWORD.
  4. Type DisableMetaFiles, and then press ENTER.
  5. On the Edit menu, click Modify to modify the DisableMetaFiles registry entry.
  6. In the Value data box, type 1, and then click OK.
  7. Exit Registry Editor.

  Impact of workaround.Turning off processing of metafiles may cause the appearance of software or system components to decrease in quality. Turning off processing of metafiles may also cause the software or system components to fail completely. It has been identified to have a potential significant functionality impact and should be evaluated and tested carefully to determine its applicability.

  Examples include the following:

• You cannot print on the computer.
• Some applications on the computer may be unable to display Clipart.
• Some scenarios that involve OLE rendering may break. This most often occurs when the object server is not active.

  For more information on this setting read Microsoft Knowledge Base Article 941835.

  How to undo the workaround.

  1. Click Start, click Run, type Regedit in the Open box, and then click OK.
  2. Locate and then click the following registry subkey:
     
     HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
  3. Delete the "DisableMetaFiles" value

  You may have to restart your computer for this change to take effect.

• Read e-mail messages in plain text format to help protect yourself from the HTML e-mail attack vector

  You can help protect yourself against this vulnerability by changing your e-mail settings to read e-mail messages in plain text using Outlook 2002 and later, Outlook Express 6 and later, or Windows Mail. For information in Outlook, search “plain text” in Help and review “Read messages in plain text.” In Outlook Express, search “plain text” in Help and review “Reducing your risk of getting e-mail viruses.” In Windows Mail, search “plain text” in Help and review “Security and privacy in Windows Mail.”

  Impact of workaround: E-mail messages that are viewed in plain text format will not contain pictures, specialized fonts, animations, or other rich content. Additionally:

  • The changes are applied to the preview pane and to open messages.
  • Pictures become attachments so that they are not lost.
  • Because the message is still in Rich Text or HTML format in the store, the object model (custom code solutions) may behave unexpectedly.

What is the scope of the vulnerability? 
This is a remote code execution vulnerability. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

What causes the vulnerability? 
The vulnerability is caused by a heap overflow when the Microsoft Color Management System (MSCMS) module of the Microsoft ICM component improperly allocates memory for a specially crafted image file.

What is ICM? 
Image Color Management (ICM) is a color management system that parses and uses data in ICC profiles to perform color translation operations. Consistent color across various displays and types of output can be problematic for content publishers. For example, in the publishing industry, consistent color throughout the commercial publishing process saves both time and money. Designers want to ensure that their clients' printed material will produce the same results when the job is passed to the service bureau, trade shop, and printer and that it will also look great when it's made available on the Internet. Differences in color space, gamut range, and gamut curve are unavoidable in most cases, because of the limitations of the devices or media in question. However, these differences can be tested for and recorded in an ICC profile using one of many software and hardware products currently available on the market. These ICC profiles are then used to communicate through the rest of the ICM system to ensure that colors are represented accurately to users, regardless of the device they use. For more information about ICM, see the following Microsoft Web site.

What is the International Color Consortium (ICC)?
The International Color Consortium is an organization whose purpose is to provide a standard by which vendors can implement color management to ensure cross vendor compatibility. For additional information about the International Color Consortium (ICC), visit the following Web site.

What might an attacker use the vulnerability to do? 
An attacker who successfully exploited this vulnerability could run arbitrary code. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

How could an attacker exploit the vulnerability? 
This vulnerability requires that a user open a specially crafted image file.

In an e-mail attack scenario, an attacker could exploit the vulnerability by sending a specially crafted image file or an Office document with a specially crafted image file embedded in it to the user and by convincing the user to open the document or view the e-mail containing the specially crafted image file.

In a Web-based attack scenario, an attacker would have to host a Web site that contains an image file that is used to attempt to exploit this vulnerability. In addition, compromised Web sites and Web sites that accept or host user-provided content could contain specially crafted content that could exploit this vulnerability. An attacker would have no way to force users to visit a specially crafted Web site. Instead, an attacker would have to convince them to visit the Web site, typically by getting them to click a link in an e-mail message or Instant Messenger message that takes them to the attacker's site.

What systems are primarily at risk from the vulnerability? 
Workstations and terminal servers are primarily at risk. Servers could be at more risk if administrators allow users to log on to servers and to run programs. However, best practices strongly discourage allowing this custom.

What does the update do? 
The security update addresses this vulnerability by modifying the way that Microsoft Color Management System (MSCMS) allocates memory to processing image files.

When this security bulletin was issued, had this vulnerability been publicly disclosed? 
No. Microsoft received information about this vulnerability through responsible disclosure. Microsoft had not received any information to indicate that this vulnerability had been publicly disclosed when this security bulletin was originally issued.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited? 
No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers and had not seen any examples of proof of concept code published when this security bulletin was originally issued.

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.

Note For supported versions of Windows XP Professional x64 Edition, this security update is the same as supported versions of the Windows Server 2003 x64 Edition security update.

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.