=====================================================================

                           CERT-Renater

               Note d'Information No. 2013/VULN497
_____________________________________________________________________

DATE                : 13/11/2013

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S):  Windows version XP, Server 2003, Vista,
                       Server 2008, 7, 8, Server 2012, RT.

======================================================================
KB2876331
https://technet.microsoft.com/en-us/security/bulletin/ms13-089
______________________________________________________________________

Microsoft Security Bulletin MS13-089 - Critical Vulnerability in Windows
Graphics Device Interface Could Allow Remote Code
Execution (2876331)

Published: Tuesday, November 12, 2013

Version: 1.0

General Information

Executive Summary

This security update resolves a privately reported vulnerability in
Microsoft Windows. The vulnerability could allow remote code execution
if a user views or opens a specially crafted Windows Write file in
WordPad. An attacker who successfully exploited this vulnerability
could gain the same user rights as the current user. Users whose
accounts are configured to have fewer user rights on the system could
be less impacted than users who operate with administrative user rights.

This security update is rated Critical for all supported releases of
Microsoft Windows.


Affected Software

Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
Windows 8 for 32-bit Systems
Windows 8 for x64-based Systems
Windows 8.1 for 32-bit Systems
Windows 8.1 for x64-based Systems
Windows Server 2012
Windows Server 2012 R2
Windows RT
Windows RT 8.1
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core
  installation)
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core
  installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core
installation)
Windows Server 2012 (Server Core installation)
Windows Server 2012 R2 (Server Core installation)

Vulnerability Information

Graphics Device Interface Integer Overflow Vulnerability - CVE-2013-3940

A remote code execution vulnerability exists in the way that the
Windows Graphics Device Interface (GDI) processes specially crafted
Windows Write files in WordPad. An attacker who successfully exploited
this vulnerability could take complete control of an affected system.
An attacker could then install programs; view, change, or delete data;
or create new accounts with full user rights. Users whose accounts are
configured to have fewer user rights on the system could be less
impacted than users who operate with administrative user rights.

To view this vulnerability as a standard entry in the Common
Vulnerabilities and Exposures list, see CVE-2013-3940.

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================