We have not identified any workarounds for this vulnerability.

What is the scope of the vulnerability?
This is a privilege elevation vulnerability. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To attempt to exploit the vulnerability, an attacker must be able to log on locally to the system and run a program.

What causes the vulnerability?
The vulnerability is caused by the incorrect handling of memory reserved for the Windows kernel by the Windows Graphics Rendering Engine when processing WMF and EMF file types.

What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could take complete control of the affected system.

How could an attacker exploit the vulnerability?
To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then try to execute a program that runs as a regular user that could exploit this vulnerability and take complete control over the affected system.

What systems are primarily at risk from the vulnerability?
Workstations are primarily at risk from this vulnerability. Servers could be at more risk if administrators allow users to log on to servers and to run programs. However, best practices strongly discourage allowing this.

Could the vulnerability be exploited over the Internet?
No. An attacker must be able to log on to the specific system that is targeted for attack. An attacker cannot load and run a program remotely by using this vulnerability.

What does the update do?
The update removes the vulnerability by modifying the way the handle is created.

When this security bulletin was issued, had this vulnerability been publicly disclosed?
Yes. While the initial report was provided through responsible disclosure, the vulnerability was later disclosed publicly by the same security researcher. It has been assigned Common Vulnerability and Exposure number CVE-2006-5758. It also has been named GDI Kernel Local Elevation of Privilege Vulnerability by the larger security community. This security bulletin addresses the publicly disclosed vulnerability as well as additional issues discovered through internal investigations.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited?
No. Microsoft had seen examples of proof of concept code published publicly but had not received any information to indicate that this vulnerability had been publicly used to attack customers when this security bulletin was originally issued.

Does applying this security update help protect customers from the code that has been published publicly that attempts to exploit this vulnerability?
Yes. This security update addresses the vulnerability that potentially could be exploited by using the published proof of concept code. The vulnerability that has been addressed has been assigned the Common Vulnerability and Exposure number CVE-2006-5758.

Microsoft has tested the following workarounds. While these workarounds will not correct the underlying vulnerability, they help block known attack vectors. When a workaround reduces functionality, it is identified in the following section.

What is the scope of the vulnerability?
This is a denial of service vulnerability. An attacker who exploited this vulnerability could cause the affectedsystem to stop responding and automatically restart. Note that the denial of service vulnerability would not allow attackers to execute code or elevate their privileges, but it could cause the affected program to stop accepting requests.

What causes the vulnerability?
The vulnerability is caused by an attempt to read a data value that contains an invalid memory reference.

What is the Windows Metafile (WMF) image formats?
The WMF image format is a 16-bit metafile format that can contain both vector information and bitmap information. It is optimized for the Windows operating system.

For more information about image types and formats, see Microsoft Knowledge Base Article 320314. Additional information about these file formats is also available at the MSDN Library Web Site.

What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could cause the affected system to stop responding and possibly restart.

Who could exploit the vulnerability?
In a Web-based attack scenario, an attacker would have to host a Web site that contains a Web page that is used to attempt to exploit this vulnerability. An attacker would have no way to force users to visit a specially crafted Web site. Instead, an attacker would have to convince them to visit the Web site, typically by getting them to click a link that takes them to the attacker's site. It could also be possible to display specially crafted Web content by using banner advertisements or by using other methods to deliver Web content to affected systems.

How could an attacker exploit this vulnerability?
The vulnerability could be exploited on the affected systems by an attacker who persuaded a user to open a specially crafted file or to view a folder that contains the specially crafted image. There is no way for an attacker to force a user to open a specially crafted file, except potentially through previewing an email message.

What systems are primarily at risk from the vulnerability? 
Workstations and terminal servers are primarily at risk. Servers could be at more risk if users who do not have sufficient administrative permissions are given the ability to log on to servers and run programs or browse the Internet. However, best practices strongly discourage allowing this.

I am running Internet Explorer on Windows Server 2003. Does this mitigate this vulnerability?
Yes. By default, Internet Explorer on Windows Server 2003 runs in a restricted mode that is known as Enhanced Security Configuration. This mode sets the security level for the Internet zone to High. This is a mitigating factor for Web sites that have not been added to Internet Explorer Trusted sites zone.

What is the Internet Explorer Enhanced Security Configuration?
Internet Explorer Enhanced Security Configuration is a group of preconfigured Internet Explorer settings that reduce the likelihood of a user or of an administrator downloading and running specially crafted Web content on a server. Internet Explorer Enhanced Security Configuration reduces this risk by modifying many security-related settings. This includes the settings on the Security tab and the Advanced tab in the Internet Options dialog box. Some of the important modifications include the following:

For more information regarding Internet Explorer Enhanced Security Configuration, see the guide, Managing Internet Explorer Enhanced Security Configuration, at the following Web site.

What does the update do?
The update removes the vulnerability by modifying the way that the affected operating system checks message inputs under certain circumstances.

When this security bulletin was issued, had this vulnerability been publicly disclosed?
No. Microsoft received information about this vulnerability through responsible disclosure.

We have not identified any mitigations for this vulnerability.

We have not identified any workarounds for this vulnerability.

What is the scope of the vulnerability?
This is a privilege elevation vulnerability. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To attempt to exploit the vulnerability, an attacker must be able to log on locally to the system and run a program.

What causes the vulnerability?
An unchecked buffer in GDI when rendering Enhanced Metafile (EMF) image format files.

What is Enhanced Metafile (EMF) image format?
The EMF image format is a 32-bit format that can contain both vector information and bitmap information.

For more information about image types and formats, see Microsoft Knowledge Base Article 320314. Additional information about these file formats is also available at the MSDN Library Web Site.

What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could take complete control of the affected system.

How could an attacker exploit the vulnerability?
To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then try to execute a program that runs as a regular user that could exploit this vulnerability and take complete control over the affected system.

What systems are primarily at risk from the vulnerability?
Workstations are primarily at risk from this vulnerability. Servers could be at more risk if administrators allow users to log on to servers and to run programs. However, best practices strongly discourage allowing this.

Could the vulnerability be exploited over the Internet?
No. An attacker must be able to log on to the specific system that is targeted for attack. An attacker cannot load and run a program remotely by using this vulnerability.

What does the update do?
The update removes the vulnerability by modifying the way that the affected operating system versions validate the length of a message before it passes the message to the allocated buffer.

When this security bulletin was issued, had this vulnerability been publicly disclosed?
No. Microsoft received information about this vulnerability through responsible disclosure.

An attacker must be able to log on locally to exploit this vulnerability. The vulnerability could not be exploited remotely or by anonymous users.

We have not identified any workarounds for this vulnerability.

What is the scope of the vulnerability?
This is a privilege elevation vulnerability. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To attempt to exploit the vulnerability, an attacker must be able to log on locally to the system and run a program.

What causes the vulnerability?
The vulnerability is caused by the processing of invalid application window sizes.

What is the Graphics Device Interface (GDI)?
The Microsoft Windows graphics device interface (GDI) enables applications to use graphics and formatted text on both the video display and the printer. Windows-based applications do not access the graphics hardware directly. Instead, GDI interacts with device drivers on behalf of applications. For more information about GDI, please visit the following MSDN article.

What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could take complete control of the affected system.

How could an attacker exploit the vulnerability?
An attacker could try to exploit the vulnerability by creating a specially crafted application and executing it on the affected system. The application could create a series of layered windows that pass an invalid parameter. In this way, an unprivileged attacker could gain complete control of the affected system.

What systems are primarily at risk from the vulnerability?
Workstations are primarily at risk from this vulnerability. Servers could be at more risk if administrators allow users to log on to servers and to run programs. However, best practices strongly discourage allowing this.

Could the vulnerability be exploited over the Internet?
No. An attacker must be able to log on to the specific system that is targeted for attack. An attacker cannot load and run a program remotely by using this vulnerability.

What does the update do?
The update resolves the vulnerability by verifying application window sizes before it passes the data to the allocated buffer

When this security bulletin was issued, had this vulnerability been publicly disclosed?
Microsoft had not received any information to indicate that this vulnerability had been publicly disclosed when this security bulletin was originally issued.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited?
No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers and had not seen any examples of proof of concept code published when this security bulletin was originally issued.

Microsoft has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they help block known attack vectors. When a workaround reduces functionality, it is identified in the following section.

What is the scope of the vulnerability?
This isa remote code execution vulnerability. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full privileges. Users whose accounts are configured to have fewer privileges on the system could be less impacted than users who operate with administrative privileges.

What are Animated Cursors?
Animated cursors are a feature that allows a series of frames to appear at the mouse pointer location instead of a single image. The Animated Cursors feature is designated by the .ani suffix.

If I block files that use the .ani file name extension, can this protect me against attempts to exploit this vulnerability?
No. The vulnerability is not constrained by the .ani file extension. Additional image file types may be used to exploit the vulnerability.

What causes the vulnerability?
The vulnerability exists in the way that Windows performs format validation prior to handling cursors, animated cursors, and icons.

What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could take complete control of the affected system.

How could an attacker exploit the vulnerability? 
An attacker could try to exploit the vulnerability by creating a specially crafted web page. An attacker could also create a specially-crafted email message and send it to an affected system. Upon viewing a web page, previewing or reading a specially crafted message, or opening a specially crafted email attachment the attacker could cause the affected system to execute code. While animated cursors typically are associated with the .ani file extension, a successful attack is not constrained by this file type.

What systems are primarily at risk from the vulnerability? 
Workstations and terminal servers are primarily at risk. Servers could be at more risk if users who do not have sufficient administrative permissions are given the ability to log on to servers and run programs or browse the Internet. However, best practices strongly discourage allowing this.

What does the update do?
The update removes the vulnerability by modifying the way that cursors, animated cursor, and icon formats are validated prior to rendering.

When this security bulletin was issued, had this vulnerability been publicly disclosed?
Yes. This vulnerability has been publicly disclosed. It has been assigned Common Vulnerability and Exposure number CVE-2007-0038.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited?
Yes. When the security bulletin was released, Microsoft had received information that this vulnerability was being exploited.

What is Microsoft’s response to the availability of third party patches for the Animated Cursor vulnerability?
Microsoft recommends that customers download and deploy the security update associated with this security bulletin.

As a general rule, it is a best practice to obtain security updates for software vulnerabilities from the original vendor of the software. With Microsoft software, Microsoft carefully reviews and tests security updates to ensure that they are of high quality and have been evaluated thoroughly for application compatibility. In addition, Microsoft’s security updates are offered in 23 languages for all affected versions of the software simultaneously.

Microsoft cannot provide similar assurance for independent third party security patches or mitigations.

Does applying this security update help protect customers from the code that has been published publicly that attempts to exploit this vulnerability?
Yes. This security update addresses the vulnerability that is being actively exploited. The vulnerability that has been addressed has been assigned the Common Vulnerability and Exposure number CVE-2007-0038.

An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability. The vulnerability could not be exploited remotely or by anonymous users

We have not identified any workarounds for this vulnerability.

What is the scope of the vulnerability?
This is a local elevation of privilege vulnerability. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker with valid logon credentials could then install programs; view, change, or delete data; or create new accounts with the same user rights as the logged-on user.

What causes the vulnerability?
When a Windows-based program renders affected types of images, the program passes color-related parameters to an unchecked memory buffer in GDI.

What is the Graphics Device Interface (GDI)?
The Microsoft Windows graphics device interface (GDI) enables applications to use graphics and formatted text on both the video display and the printer. Windows-based applications do not access the graphics hardware directly. Instead, GDI interacts with device drivers on behalf of applications. For more information about GDI please visit the following MSDN article.

What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could take complete control of the affected system.

How could an attacker exploit this vulnerability?
Any program that renders the affected image types could be vulnerable to this attack. An attacker could locally log on to the system and then run a specially designed program that could exploit the vulnerability.

What systems are primarily at risk from the vulnerability?
Workstations and terminal servers are primarily at risk. Servers could be at more risk if administrators allow users to log on to servers and to run programs or browse web pages. However, best practices strongly discourage allowing this.

What does the update do?
The update removes the vulnerability by modifying the way that the Graphic Device Interface validates the length of data before passing the data to the allocated buffer.

When this security bulletin was issued, had this vulnerability been publicly disclosed?
No. Microsoft received information about this vulnerability through responsible disclosure.

Attempts to exploit this vulnerability will most probably result in a denial of service condition caused by an unexpected restart of the affected system rather than local elevation of privilege.

We have not identified any workarounds for this vulnerability.

What is the scope of the vulnerability?
This is a local elevation of privilege vulnerability. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker with valid logon credentials could then install programs; view, change, or delete data; or create new accounts with full user rights.

What causes the vulnerability?
When processing defective or modified fonts, the TrueType Font Rasterizer may call an uninitialized function pointer.

What is True Type Font Rasterizer?
The TrueType Font Rasterizer generates character bitmaps for screens and printers, otherwise known as raster devices.

What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could take complete control of the affected system.

Who could exploit the vulnerability?
To try to exploit the vulnerability, an attacker must be able to log on locally to a system and run a program.

How could an attacker exploit the vulnerability?
An attacker could create an application that uses a specially crafted font such that, when the True Type Font Rasterizer tries to render the specially crafted font, the Rasterizer would allow the attacker to take complete control of the affected system.

What systems are primarily at risk from the vulnerability?
Workstations and terminal servers are primarily at risk. Servers could be at more risk if administrators allow users to log on to servers and to run programs. However, best practices strongly discourage allowing this.

What does the update do?
The update removes the vulnerability by changing the way that the True Type Font Rasterizer initializes True Type fonts.

When this security bulletin was issued, had this vulnerability been publicly disclosed?
No. Microsoft received information about this vulnerability through responsible disclosure.