This patch for the Microsoft Clip Art Gallery addresses a vulnerability
that could cause a buffer overrun in Clip Art Gallery. The buffer overrun
could cause Clip Art Gallery to crash, or it could make the user's
computer vulnerable to harmful code created by a malicious hacker.
Malicious code, embedded within a file that is downloaded by Clip Art
Gallery, could then cause damage to information stored on the
user's computer.
Clip Art Gallery and Clip Gallery Live use
a special file format — the .CIL format — for
downloading these clips. Under certain circumstances, a very long field
embedded in a clip art .CIL file could cause a buffer overrun in the Clip
Art Gallery software. When the buffer overrun occurs, the software could
crash or could cause the execution of arbitrary code on a user's computer.
The primary danger in this vulnerability is that the buffer overrun would
occur when a user opens an attachment that includes a specially formed
clip art file, or downloads a .CIL file from a malicious hacker's Web
page.
For example, a user finds a Web site that contains groups of clip art
saved in the .CIL format. The user downloads one of these .CIL files to
use in Microsoft PowerPoint® 2000. The instructions on the page tell the
user to double-click the file to open Clip Art Gallery. However, the
person who created the Web site has embedded malicious code that deletes
data on the user's hard disk. To make the malicious code execute, the
person includes a very long field in the .CIL file. When the user
double-clicks the file to open it into Clip Art Gallery, Clip Art Gallery
experiences a buffer overrun, and then the malicious code executes.
Since Clip Art Gallery installs and opens clips without prompting users
for confirmation, this vulnerability can affect users even if they follow
safe computing practices such as using virus detection software.
For users of PhotoDraw 2000 Version 1 This patch works with PhotoDraw 2000 Version 2. If you are using PhotoDraw 2000 Version 1, you need to install a different patch, CILUpdt.exe. Download instructions and CILUpdt.exe itself can be found at Microsoft Clip Gallery PSS: Microsoft Clip Gallery Buffer Overrun Vulnerability Patch.
Note Microsoft Works 2000, PictureIt! 2000,
Greetings 99, Greetings 2000, Home Publishing 99, and Home Publishing 2000 are
also subject to this vulnerability.
Additional information is available in the Microsoft Security Bulletin (MS00-015): "Clip Art Buffer Overrun" Vulnerability and the Microsoft Knowledge Base article (Q256167) CG5: Clip Art Buffer Overrun Vulnerability Patch.
