CVE:CVE-2007-3034
CNNVD:CNNVD-200708-228
"Microsoft Windows是美国微软（Microsoft）公司发布的一系列操作系统。
Windows的图形设备接口(GDI)的GDI32函数AttemptWrite处理Windows元文件时可能会出现整数溢出，远程攻击者可能利用此漏洞提升自己的权限。
如下反汇编所示，很多GDI32 API函数都会调用AttemptWrite，如CreateMetaFileW。
   77F4B519  mov  esi, [ebp+0Ch]  ; reported size of record in bytes
     ...                           ;   (user-controlled)
    77F4B548  mov  eax, [ebx+0Ch]  ; amount of buffer used in bytes
                                   ;   (user-controlled)
    77F4B548  lea  ecx, [eax+esi]  ; *** integer overflow ***
    77F4B54E  cmp  ecx, [ebx+08h]  ; buffer capacity
    77F4B551  ja   _no_memcpy
     ...
    77F4B56D  mov  edi, [ebx]      ; pointer to start of buffer
    77F4B56F  mov  ecx, esi
    77F4B574  add  edi, eax        ; now EDI points to unused buffer space
     ...
    77F4B5BA  mov  eax, ecx
    77F4B5BC  shr  ecx, 2
    77F4B5BF  rep movsd            ; *** complete heap overwrite ***
如果创建了包含有超大记录长度的元文件就会触发堆溢出，因为memcpy试图将大约4GB的任意数据拷贝到堆块。这个拷贝大小会导致访问破坏，但在可以处理这种异常的程序中会导致执行任意指令。"
solution:Upgrade microsoft windows_2000 to a higher version than *:sp4,and avoid the version *:sp4; Upgrade microsoft windows_2003_server to a higher version than *:sp1,*:sp2,and avoid the version *:sp1,*:sp2; Upgrade microsoft windows_server_2003 to a higher version than *; Upgrade microsoft windows_xp to a higher version than *,*:sp2,and avoid the version *:sp2