Cloudanix VulnDB

CVE-2017-0038

Medium · 5.5

CVSS

5.5

EPSS

82.2%

Published

Feb 20, 2017

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Attend

A problem in older Windows graphics handling could let attackers read private information from a computer's memory when someone opens a specially made image file.

Exploit Available
Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Data Exposure
Component
Library
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw in gdi32.dll permits reading sensitive data from process heap memory when processing a crafted EMF file containing an EMR_SETDIBITSTODEVICE record with manipulated DIB dimensions, stemming from an incomplete remediation of prior similar issues.

Why it matters to the business

Attackers may obtain private data from memory on affected Windows systems, potentially exposing credentials or other sensitive information and increasing risk of further compromise on legacy deployments still in use.

How an attack unfolds

An attacker crafts an EMF file with altered DIB dimensions in the EMR_SETDIBITSTODEVICE record and delivers it to a target, such as via email attachment or web download; when the victim opens or previews the file on an unpatched system, gdi32.dll leaks heap memory contents to the attacker.

How to fix it

Apply the latest cumulative updates for supported Windows versions; for unsupported platforms such as Vista, Server 2008, and Windows 7, isolate or replace the systems and avoid handling untrusted EMF files.

How to confirm the fix worked

Verify patch installation through Windows Update history or vendor advisories; test by attempting to open known-malformed EMF samples in a controlled environment and confirm no heap disclosure occurs.

Typical attack path

  1. Craft malicious EMF file exploiting EMR_SETDIBITSTODEVICE record
  2. Deliver file to victim via email, download, or shared storage
  3. Victim opens or renders the EMF file in an affected application
  4. gdi32.dll processes the malformed record and discloses heap memory

How to detect it

Search application and system logs for EMF file processing events around the time of suspected incidents; inspect for repeated or anomalous EMR_SETDIBITSTODEVICE records in user-opened files.

  • EMR_SETDIBITSTODEVICE
  • crafted EMF with modified DIB dimensions

What your security team should do

  • Prioritize patching or decommissioning affected legacy Windows systems given high EPSS and available exploits
  • Block or sandbox EMF file handling in email gateways and browsers
  • Monitor for any remaining usage of unsupported Windows versions across the environment

The record

gdi32.dll in Graphics Device Interface (GDI) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows remote attackers to obtain sensitive information from process heap memory via a crafted EMF file, as demonstrated by an EMR_SETDIBITSTODEVICE record with modified Device Independent Bitmap (DIB) dimensions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-3216, CVE-2016-3219, and/or CVE-2016-3220.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities