Zero-Day Advisory

Fortinet Discovers Microsoft Journal Heap Overflow Vulnerability

Summary

Fortinet's FortiGuard Labs has discovered a heap overflow vulnerability in Windows Journal.
Windows Journal is a note-taking application that was first introduced in Windows XP Tablet PC Edition. It's currently a component of all supported client versions of Windows through Windows 10 Version 1511.
A heap overflow vulnerability has been discovered in Windows Journal. The vulnerability can be triggered with a crafted .jtp file which causes an out of bounds memory write, due to improper bounds checking. It could allow malicious users to create code execution scenarios.

Solutions

FortiGuard Labs released the following FortiGate IPS signature which covers this specific vulnerability:

MS.Windows.Journal.memcpy.Heap.Overflow
Released Sep 12, 2016
Users should apply the solution provided by Microsoft.

Additional Information

The file format used by Windows Journal has been demonstrated to be susceptible to many security exploits. Therefore, Microsoft removes Journal from all versions of Windows in KB3161102.

References

Acknowledgement

This vulnerability was discovered by Honggang Ren of Fortinet's FortiGuard Labs.

IPS Subscription

Fortinet customers who subscribe to Fortinet's intrusion prevention (IPS) service should be protected against this vulnerability with the appropriate configuration parameters in place. Fortinet's IPS service is one component of FortiGuard Subscription Services, which also offer comprehensive solutions such as antivirus, Web content filtering and antispam capabilities. These services enable protection against threats on both application and network layers. FortiGuard Services are continuously updated by FortiGuard Labs, which enables Fortinet to deliver a combination of multi-layered security intelligence and true zero-day protection from new and emerging threats. These updates are delivered to all FortiGate, FortiMail and FortiClient products. Fortinet strictly follows responsible disclosure guidelines to ensure optimum protection during a threat's lifecycle.