Microsoft Windows CreateSizedDIBSECTION Stack Buffer Overflow

This module exploits a stack-based buffer overflow in the handling of thumbnails within .MIC files and various Office documents. When processing a thumbnail bitmap containing a negative 'biClrUsed' value, a stack-based buffer overflow occurs. This leads to arbitrary code execution. In order to trigger the vulnerable code, the folder containing the document must be viewed using the "Thumbnails" view.

Search Other Modules

Exploit Rank

• Great

Exploit Authors

• Moti & Xu Hao < >
• Yaniv Miron aka Lament of ilhack < >
• jduck < jduck [at] metasploit.com >

Vulnerability References

• CVE-2010-3970
• OSVDB-70263
• MSB-MS11-006
• BID-45662
• http://www.microsoft.com/technet/security/advisory/2490606.mspx
• http://www.powerofcommunity.net/schedule.html

Exploit Targets

• 0 - Automatic (default)
• 1 - Windows 2000 SP0/SP4 English
• 2 - Windows XP SP3 English
• 3 - Crash Target for Debugging

Exploit Development

• Source Code
• History

Similar Exploit Modules

• exploit/windows/fileformat/a-pdf_wav_to_mp3
• exploit/windows/fileformat/acdsee_fotoslate_string
• exploit/windows/fileformat/acdsee_xpm
• exploit/windows/fileformat/activepdf_webgrabber
• exploit/windows/fileformat/adobe_collectemailinfo
• exploit/windows/fileformat/adobe_cooltype_sing
• exploit/windows/fileformat/adobe_flashplayer_button
• exploit/windows/fileformat/adobe_flashplayer_newfunction
• exploit/windows/fileformat/adobe_flatedecode_predictor02
• exploit/windows/fileformat/adobe_geticon

Exploit Usage Information

Exploit Module Options