Microsoft Internet Explorer BMP file memory DoS vulnerability

[Arman Nayyeri <arman-n@xxxxxxxxxxxx>]

Microsoft Internet Explorer BMP file memory DoS vulnerability
=============================================================
Title:     Microsoft Internet Explorer BMP file memory DoS vulnerability
Vuln Name: 58 bytes BMP vs 51,539,607,528 GB memory
Date:      Sunday, April 11, 2004
Software:  Internet Explorer v5.0-v6.0 
           (i guess perior versions are vulnerable)
Vendor:    Microsoft Corporation
Patch:     N/A (Look at "Vendor Status" section)
Author:    Arman Nayyeri, arman[at]4rman.com, http://www.4rman.com
Severity:  Low


Description:
============
When a BMP file loaded into the Internet Explorer (for exmaple 'IMG' tag)
the internet explorer check the BMP image size written in BMP file, and then 
allocate the necessary memory to itself for placing bmp image into 
the memory.
And it does not check the actual size of the file, so we can write a large
number in the bmp file and cause the IE to fill the memory up.
But we can't use a very large number because IE will check to see if there is
enough memory available, if not, it doesn't load it at all.
The max size of the bitmap is FFFFFFFF^2 (large number ;) ).
so the tiny (58 bytes) bitmap can take up to 51,539,607,528 GB memory.

Exploit:
========
The exploit that I provided is an html page with many IMG tags that loading
several BMP files with different sizes. So the memory fills up completely.

WARNING!!!!!
This DoS will cause serious system instability, please save your work 
before loading this page, you may need to restart your computer!

Here is the page:
http://www.4rman.com/exploits/tinybmp.htm

please, take a look at my website too! 
http://www.4rman.com


Exploit Tested On
=================
Internet Explorer 5.5
                        on
                        Microsoft Windows 2000 Server SP4
                        Microsoft Windows ME
Internet Explorer 6.0
                        on
                        Microsoft Windows XP
                        Microsoft Windows XP SP1
                        Microsoft Windows 2003 Enterprise

Vendor Status
=============
Microsoft notified about 3 month ago.
The bug will be fixed as part of the next possible service pack.

Special Thanks
==============
Special thanks to god.


Do I discover more vulnerabilities?
===================================
Maybe!(heh)


Disclaimer:
===========
Arman Nayyeri is not responsible for the misuse of the information 
provided in this advisory. The opinions expressed are my own and not of 
any company. In no event shall the author be liable for any damages 
whatsoever arising out of or in connection with the use or spread of this 
advisory. Any use of the information is at the user's own risk.

~~~~~~~~~~~~~~
and sorry for my bad english,
Arman Nayyeri
                From
                        Iran
http://www.4rman.com