Perigo nos cursores animados

Mais um exemplo dos sítios recôndidos onde se pode esconder uma vulnerabilidade... que "apenas" permite execução de código na máquina da vítima.


Microsoft Windows ANI header stack buffer overflow
National Cyber Alert System
Technical Cyber Security Alert TA07-089A
Original release date: March 30, 2007

Systems Affected
Microsoft Windows 2000, XP, Server 2003, and Vista are affected.
Applications that provide attack vectors include:
* Microsoft Internet Explorer
* Microsoft Outlook
* Microsoft Outlook Express
* Microsoft Windows Mail
* Microsoft Windows Explorer

A stack buffer overflow exists in the code that Microsoft Windows uses to processes animated cursor files. Specifically, Microsoft Windows fails to properly validate the size of an animated cursor file header supplied in animated cursor files.

Animated cursor files can be included with HTML files. For instance, a web site can use an animated cursor file to specify the icon that the mouse pointer should use when hovering over a hyperlink. Because of this, malicious web pages and HTML email messages can be used to exploit this vulnerability. In addition, animated cursor files are automatically parsed by Windows Explorer when the containing folder is opened or the file is used as a cursor. Because of this, opening a folder that contains a specially crafted animated cursor file will also trigger this vulnerability.

Note that Windows Explorer will process animated cursor files with several different file extensions, such as .ani, .cur, or .ico. Furthermore, Windows will automatically render animated cursor files referenced by HTML documents regardless of the animated cursor file extension. This vulnerability is actively being exploited.
More information is available in Vulnerability Note VU#191609.

A remote, unauthenticated attacker may be able to execute arbitrary code. Exploitation may occur when a user clicks a malicious link, reads or forwards a specially crafted HTML email, or accesses a folder containing a malicious animated cursor file.

Fonte: US-CERT
Documento completo e actualizado:
http://www.us-cert.gov/cas/techalerts/TA07-089A.html