CVE-2013-3906
HIGHCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
5Tags
Description
GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remote attackers to execute arbitrary code via a crafted TIFF image, as demonstrated by an image in a Word document, and exploited in the wild in October and November 2013.
Analysis
GDI+ in Microsoft Windows and Office fails to properly handle TIFF images, allowing remote code execution through crafted documents, actively exploited in targeted attacks against Pakistani and Middle Eastern organizations.
Technical Context
The CWE-94 vulnerability in GDI+'s TIFF codec allows specially crafted TIFF images to trigger code execution when rendered by any application using GDI+ (including Office, Lync, and Windows Photo Viewer). Attackers embedded exploit TIFF images in Word documents for delivery.
Affected Products
['Microsoft Windows Vista SP2', 'Microsoft Windows Server 2008 SP2', 'Microsoft Office 2003 SP3', 'Microsoft Office 2007 SP3', 'Microsoft Office 2010 SP1/SP2', 'Microsoft Lync 2010/2013']
Remediation
Apply Microsoft security update MS13-096. Disable TIFF rendering via the TIFF codec workaround. Block documents with embedded TIFF images at the email gateway.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today