NIST IT Security: Content / / Lotus Notes vulnerable to MS Windows graphics rendering engine bug

NIST Site Search

Product Research

Advertise on this site

Headlines

US-CERT Current Activity

»	Insecure Loading of Dynamic Link Libraries in Windows Applications
»	VMware Releases Updates for ESX Service Console Packages
»	Cisco Releases Security Advisory for IOS XR Software Border Gateway Protocol
»	RealNetworks Releases Update to Address Vulnerabilities in RealPlayer
»	Cisco Releases Advisories for Unified Communications Manager and Unified Presence
»	APWG Fax Back Phishing Education Program
»	Adobe Releases Security Bulletin for Shockwave Player
»	Apple Releases Security Update 2010-005
»	Microsoft Releases Security Advisory
»	VideoLAN Releases a Security Advisory for VLC Media Player

Date published: not known
Details

DOE-CIRC Updates

»	T-430: Apple QuickTime Flaw in QTPlugin.ocx ActiveX Control Lets Remote Users Execute Arbitrary Code Apple QuickTime Flaw in QTPlugin.ocx ActiveX Control Lets Remote Users Execute Arbitrary Code
»	T-429: WaspTime MS-SQL Database instance with blank password for sa account WaspTime MS-SQL Database instance with blank password for sa account
»	T-428: Vulnerability in Help and Support Center Vulnerability in Help and Support Center
»	T-427: VMWare WebAccess Vulnerability VMWare WebAccess Vulnerability
»	T-426: Microsoft Windows Shortcut 'LNK/PIF' Files Automatic File Execution Vulnerability Microsoft Windows Shortcut 'LNK/PIF' Files Automatic File Execution Vulnerability
»	T-425: Desktop Java running in web browsers Desktop Java running in web browsers
»	T-424: Windows TCP/IP Stack IcmpSendEcho2Ex() Bug Lets Local Users Deny Service Windows TCP/IP Stack IcmpSendEcho2Ex() Bug Lets Local Users Deny Service
»	T-423: Microsoft Security Advisory (2269637) - Insecure Library Loading Could Allow Remote Code Execution Microsoft Security Advisory (2269637) - Insecure Library Loading Could Allow Remote Code Execution
»	T-422: Adobe Flash Player and AIR (CVE-2010-2216) Unspecified Memory Corruption Vulnerability Adobe Flash Player and AIR (CVE-2010-2216) Unspecified Memory Corruption Vulnerability
»	T-421: Multiple CACTI Security Vulnerabilities Multiple CACTI Security Vulnerabilities
»	T-420: Microsoft Windows TCP/IP IPv6 Extension Header Remote Denial of Service Vulnerability Microsoft Windows TCP/IP IPv6 Extension Header Remote Denial of Service Vulnerability
»	T-419: PHP 'ibase_gen_id()' Function off-by-one Buffer Overflow Vulnerability PHP 'ibase_gen_id()' Function off-by-one Buffer Overflow Vulnerability
»	T-418: Adobe Acrobat and Reader Font Parsing Remote Code Execution Vulnerability Adobe Acrobat and Reader Font Parsing Remote Code Execution Vulnerability
»	T-417: Apache HTTP Server Multiple Remote Denial of Service Vulnerabilities Apache HTTP Server Multiple Remote Denial of Service Vulnerabilities
»	T-417: Apache HTTP Server Multiple Remote Denial of Service Vulnerabilities Apache HTTP Server Multiple Remote Denial of Service Vulnerabilities

Date published: not known
Details

Virus Bulletin news

»	ARF published as IETF standard Abuse report format helps auto-handling of email complaints
»	Microsoft releases new fix for DLL vulnerability Earlier workaround believed to be too complex for most users.
»	Malicious tweets link to fake TweetDeck update Twitter resets passwords for accounts that appear to have been hacked.
»	94% of Internet users befriend unknown 'good-looking woman' Sensitiva data shared after two-hour chat.
»	Investment boost for Quick Heal Indian security firm gets hefty cash injection.
»	41% of spam sent via Rustock botnet Botnet spam back after short summer break.
»	Avast gets $100m investment boost Growth equity firm invests in Czech firm
»	Computer chip giant buys AV giant Intel becomes new owner of McAfee for the princely sum of $7.8bn
»	AV-Test.org issues latest round of testing results Symantec and Microsoft outdo Trend and McAfee in live tests.

Date published: not known
Details

DarkReading - All Stories

»	Networked Scanners Offer A Window Into The Enterprise, Researcher Says Emerging Web-based features make it possible to capture document contents remotely from networked sc ...
»	U.S. Businesses Could Lose Up To $1 Billion In Online Banking Fraud This Year Small- to midsized businesses taking the biggest hit, experts say, but consumer banking customers co ...
»	Product Watch: Verizon, VMware Team Up With Hybrid Cloud Service New Verizon service offers private public-cloud option
»	Could USB Flash Drives Be Your Enterprise's Weakest Link? The Pentagon last week conceded that a USB flash drive carried an attack program inside a classified ...
»	Delaware Contractor Mistakenly Posts Personal Data Of 22,000 Employees State of Delaware contractor Aon mistakenly posts personal data of 22,000 retirees without randomiza ...
»	IBM Corrects Unpatched Vulnerability Numbers After Google Challenge X-Force Team at IBM revises data on vendors with most unpatched bugs in recent IBM X-Force 2010 Mid- ...
»	Major Disruption of Pushdo Botnet Wasn't The Original Goal Botnet's spam traffic cut by 80 percent
»	China, Taiwan Nab 450 Suspects In Biggest Fraud Raid Ever Law enforcement authorities in China, Taiwan seize cash, fraud "manuals" from alleged tele ...
»	Four Best Practices For Tokenization Going beyond Visa's best practices guide

Date published: not known
Details

Lotus Notes vulnerable to MS Windows graphics rendering engine bug

in General IT Security > Vulnerabilities

As originally discovered by John Herron at NIST.org (posted below) Lotus Notes is vulnerable to the WMF exploit.

IBM Has released a technical bulletin that points out that their Lotus Notes product is vulnerable to the WMF exploit as follows:

Lotus Notes accesses shimgvw.dll under the following circumstances:

When opening (launching) an image file attachment
When double clicking on (activating) an OLE object that uses the image viewer control
When the form is set to auto-launch first OLE object and the object uses the image control. In received emails, you have to say "Yes" to launch it before it will activate the object
When creating an OLE object that uses the image control
When browsing for a file in a folder (which is set to display thumbnails) that contains any image file

Update 3 Jan 2006: Further research is indicating that Lotus Notes code is probably not directly vulnerable. However, Lotus Notes uses Windows function calls for file browsing and when attaching or saving a file it's Windows that calls the vulnerable "shimgvw.dll" file. The Sysinternals Filemon program attributes calls to the shimgvw.dll to Lotus Notes even though it is not actually the nlnotes.exe calling the DLL directly as the screenshot indicates. Many applications call on Windows for file browsing, not just Lotus Notes. However this does not mean that all is well. If you use Windows XP it will create thumbnails of images when browsing folders through Notes and that's enough to trigger the exploit in an infected file. It's highly recommended that you install the unofficial Microsoft patch now, before its too late. See the following article for more information and a link to the patch (this patch is recommended by both SANS.org and NIST.org, as well as several antivirus companies).

Here is IBM's Technote on the matter.

----- Original posting
Lotus Notes uses the same vulnerable shimgvw.dll graphics rendering engine file implicated in the Microsoft Security Advisory (912840) to view image file attachments. Because of this, all Lotus Notes users are vulnerable to the WMF zero-day exploit. At this point there is little that can be done except block all incoming images at the perimeter.

Someone, or an email worm, simply needs to email a person a message with a graphics file attachment. It doesn't matter if the person Views or Opens (Runs) the attachment the shimgvw.dll will be used to render the image and the malicious file can compromise the computer.

To verify that Lotus Notes uses the vulnerable DLL file a program called FileMon was used:

The following screenshot shows the attached image that was viewed above. Note that the WMF file had been renamed to have a .JPG extension. The image was still viewed as normal.

This vulnerabilty can be exploited by malicious people to compromise a vulnerable system. NOTE: Exploit code is publicly available. This is being exploited in the wild.

Lotus Notes vulnerability discovered by John Herron // NIST.org

COMLAN_99

Lotus Notes vulnerable to MS Windows graphics rendering engine bugVALVAGIO | 05 Jan : 02:15

COMLAN_99: 2

COMLAN_145 04 Jan : 10:18
COMLAN_326

Hi John

I do not know if the following can refute what you have written, let me know.

1) I have deleted (disabling the Windows File Protection) the
windowssystem32shimgvw.dll file
2) I have opened an e-mail using Lotus Notes Client 6.5.3 that contains a WMF file attachment.
3) I have tried to "Open" it but i got the following error
"Sorry an application to Open this document cannot be found", of course this is normal.
4) I have tried to "View" it , and the internal Lotus Notes viewer showed the image without problem and, using the Sysinternal tool Filemon, I have seen that the LN client has tried to "use" the shimgvw.dll file but it got a NOT FOUND errors two times, it means that LN is able to show the WMF image also "without" the vulnerable DLL.

The question is :
Is Lotus Notes using the vulnerable DLL in a way that can trigger the vulnerability ?

Best Regards

Marco Correnti
ESACERT

Lotus Notes vulnerable to MS Windows graphics rendering engine bugVALVAGIO | 05 Jan : 04:15

COMLAN_99: 2

COMLAN_145 04 Jan : 10:18
COMLAN_326

Hi John

I have performed another test.

1) I have disabled using regsvr32 the vulnerable dll %windir%system32shimgvw.dllshimgvw.dll

2) using the LN client 6.5.3 I was unable to "Open" a WMF file (no error message, nothing at all), of course this is almost normal.

3) I have tried to "View" it and the internal Lotus Notes viewer showed the image without problem and, using the Sysinternal tool Filemon, I have seen that the LN client has tried only one time to do a "QUERY INFORMATION" with a "SUCCESS" result, then it has used others "Lotus Notes" dll to, I suppose, render the image i.e. kvvapi.dll, kwad.dll, kwres, kpifutil.dll, kvpicve.dll, kpwm2rdr.dll. (in this case also a Lotus Notes Keyview.ini file has been used)

Moreover in a normal situation (the dll is registered) this happens :

a) "Open"ing the WMF image : three "QUERY INFORMATION" have been performed by the LN client on the vulnerable dll, nothing else.
b) "View"ing the WMF image : one "QUERY INFORMATION" has been performed by the LN client on the vulnerable dll, nothing else. The above Lotus Notes dll have been used as the Lotus Notes ini file.

So no "READ", "SET INFORMATION" or "OPEN" have been performed (these are showed in your Filemon output)

I have used a "normal" WMF image.

Hope this help

Marco Correnti
ESACERT

Lotus Notes <span class=deros68 | 05 Jan : 10:27

COMLAN_99: 1

COMLAN_145 05 Jan : 09:39
COMLAN_326

John,

without going into all the details - I created the exploit from the metaslpoit POC and tested it under Notes 6.5.3 client. It did not trigger the overflow in gdi32.dll. Opening it outside Notes - with explorer (or browsing the directory it resides in) - the exploit was triggered and I got a call to "SetAbortProc" - which the exploit code tries to invoke. YMMV - but my 6.5.3 is not vulnerable !!

Hope IBM will soon verify/deny this vulnerability!

Reply to this COMLAN_321 COMLAN_322

Translate to: