ID CVE-2005-2123
Summary Multiple integer overflows in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allow remote attackers to execute arbitrary code via crafted Windows Metafile (WMF) and Enhanced Metafile (EMF) format images that lead to heap-based buffer overflows, as demonstrated using MRBP16::bCheckRecord.
References
Vulnerable Configurations
  • cpe:2.3:o:microsoft:windows_2000:-:sp4:-:fr
    cpe:2.3:o:microsoft:windows_2000:-:sp4:-:fr
  • cpe:2.3:o:microsoft:windows_2003_server:64-bit
    cpe:2.3:o:microsoft:windows_2003_server:64-bit
  • cpe:2.3:o:microsoft:windows_2003_server:itanium
    cpe:2.3:o:microsoft:windows_2003_server:itanium
  • cpe:2.3:o:microsoft:windows_2003_server:r2
    cpe:2.3:o:microsoft:windows_2003_server:r2
  • cpe:2.3:o:microsoft:windows_2003_server:sp1
    cpe:2.3:o:microsoft:windows_2003_server:sp1
  • cpe:2.3:o:microsoft:windows_2003_server:sp1:-:itanium
    cpe:2.3:o:microsoft:windows_2003_server:sp1:-:itanium
  • cpe:2.3:o:microsoft:windows_xp:-:64-bit
    cpe:2.3:o:microsoft:windows_xp:-:64-bit
  • Microsoft windows xp_sp1 tablet_pc
    cpe:2.3:o:microsoft:windows_xp:-:sp1:tablet_pc
  • Microsoft windows xp_sp2 tablet_pc
    cpe:2.3:o:microsoft:windows_xp:-:sp2:tablet_pc
CVSS
Base: 7.5 (as of 30-11-2005 - 10:05)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
exploit-db via4
description MS Windows Metafile (mtNoObjects) Denial of Service Exploit (MS05-053). CVE-2005-0803,CVE-2005-2123,CVE-2005-2124. Dos exploit for windows platform
id EDB-ID:1346
last seen 2016-01-31
modified 2005-11-30
published 2005-11-30
reporter Winny Thomas
source https://www.exploit-db.com/download/1346/
title Microsoft Windows Metafile - mtNoObjects Denial of Service Exploit MS05-053
nessus via4
NASL family Windows : Microsoft Bulletins
NASL id SMB_NT_MS05-053.NASL
description The remote host contains a version of Microsoft Windows missing a critical security update to fix several vulnerabilities in the Graphic Rendering Engine, and in the way Windows handles Metafiles. An attacker could exploit these flaws to execute arbitrary code on the remote host by sending a specially crafted Windows Metafile (WMF) or Enhanced Metafile (EMF) to a victim on the remote host. When viewing the malformed file, a buffer overflow condition occurs that may allow the execution of arbitrary code with the privileges of the user.
last seen 2019-02-21
modified 2018-11-15
plugin id 20172
published 2005-11-08
reporter Tenable
source https://www.tenable.com/plugins/index.php?view=single&id=20172
title MS05-053: Vulnerabilities in Graphics Rendering Engine Could Allow Code Execution (896424)
oval via4
  • accepted 2011-05-16T04:00:15.176-04:00
    class vulnerability
    contributors
    • name Robert L. Hollis
      organization ThreatGuard, Inc.
    • name Anna Min
      organization BigFix, Inc
    • name Shane Shaffer
      organization G2, Inc.
    • name Sudhir Gandhe
      organization Telos
    • name Shane Shaffer
      organization G2, Inc.
    description Multiple integer overflows in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allow remote attackers to execute arbitrary code via crafted Windows Metafile (WMF) and Enhanced Metafile (EMF) format images that lead to heap-based buffer overflows, as demonstrated using MRBP16::bCheckRecord.
    family windows
    id oval:org.mitre.oval:def:1063
    status accepted
    submitted 2005-11-09T12:00:00.000-04:00
    title WMF Rendering Code Execution Vulnerability (Windows 2000)
    version 69
  • accepted 2011-05-16T04:00:27.415-04:00
    class vulnerability
    contributors
    • name Robert L. Hollis
      organization ThreatGuard, Inc.
    • name Dragos Prisaca
      organization Gideon Technologies, Inc.
    • name Shane Shaffer
      organization G2, Inc.
    • name Sudhir Gandhe
      organization Telos
    • name Shane Shaffer
      organization G2, Inc.
    description Multiple integer overflows in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allow remote attackers to execute arbitrary code via crafted Windows Metafile (WMF) and Enhanced Metafile (EMF) format images that lead to heap-based buffer overflows, as demonstrated using MRBP16::bCheckRecord.
    family windows
    id oval:org.mitre.oval:def:1175
    status accepted
    submitted 2005-11-09T12:00:00.000-04:00
    title WMF Rendering Code Execution Vulnerability (32-bit Windows XP,SP2)
    version 69
  • accepted 2011-05-16T04:00:43.924-04:00
    class vulnerability
    contributors
    • name Robert L. Hollis
      organization ThreatGuard, Inc.
    • name Jonathan Baker
      organization The MITRE Corporation
    • name Shane Shaffer
      organization G2, Inc.
    • name Sudhir Gandhe
      organization Telos
    • name Shane Shaffer
      organization G2, Inc.
    description Multiple integer overflows in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allow remote attackers to execute arbitrary code via crafted Windows Metafile (WMF) and Enhanced Metafile (EMF) format images that lead to heap-based buffer overflows, as demonstrated using MRBP16::bCheckRecord.
    family windows
    id oval:org.mitre.oval:def:1263
    status accepted
    submitted 2005-11-09T12:00:00.000-04:00
    title WMF Rendering Code Execution Vulnerability (64-bit Windows XP and Server 2003,Unpatched)
    version 69
  • accepted 2011-05-16T04:01:17.604-04:00
    class vulnerability
    contributors
    • name Robert L. Hollis
      organization ThreatGuard, Inc.
    • name Mike Lah
      organization The MITRE Corporation
    • name Shane Shaffer
      organization G2, Inc.
    • name Sudhir Gandhe
      organization Telos
    • name Shane Shaffer
      organization G2, Inc.
    description Multiple integer overflows in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allow remote attackers to execute arbitrary code via crafted Windows Metafile (WMF) and Enhanced Metafile (EMF) format images that lead to heap-based buffer overflows, as demonstrated using MRBP16::bCheckRecord.
    family windows
    id oval:org.mitre.oval:def:1546
    status accepted
    submitted 2005-11-09T12:00:00.000-04:00
    title WMF Rendering Code Execution Vulnerability (32-bit Windows XP,SP1)
    version 69
  • accepted 2011-05-16T04:03:22.258-04:00
    class vulnerability
    contributors
    • name Robert L. Hollis
      organization ThreatGuard, Inc.
    • name Shane Shaffer
      organization G2, Inc.
    • name Sudhir Gandhe
      organization Telos
    • name Shane Shaffer
      organization G2, Inc.
    description Multiple integer overflows in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allow remote attackers to execute arbitrary code via crafted Windows Metafile (WMF) and Enhanced Metafile (EMF) format images that lead to heap-based buffer overflows, as demonstrated using MRBP16::bCheckRecord.
    family windows
    id oval:org.mitre.oval:def:701
    status accepted
    submitted 2005-11-09T12:00:00.000-04:00
    title WMF Rendering Code Execution Vulnerability (64-bit Windows XP and Server 2003,SP1)
    version 68
refmap via4
bid 15352
cert TA05-312A
cert-vn VU#300549
confirm http://support.avaya.com/elmodocs2/security/ASA-2005-228.pdf
misc http://www.eeye.com/html/research/advisories/AD20051108b.html
ms MS05-053
sectrack 1015168
secunia
  • 17223
  • 17461
  • 17498
vupen ADV-2005-2348
Last major update 07-03-2011 - 21:23
Published 29-11-2005 - 16:03
Last modified 12-10-2018 - 17:37
Back to Top