Microsoft
Windows Graphics Rendering Engine WMF SetAbortProc Code Execution
Vulnerability
Date Discovered: December 28, 2005
About
Microsoft Windows WMF graphics rendering engine is vulnerable
to a remote code execution affecting the "SetAbortProc"
function.
The vulnerability presents itself when a user views a malicious
WMF formatted file, triggering the vulnerability when the
engine parses the file.
If successfully exploited a remote hacker could gain full
control of the system if the user is currently logged into
an administrator account. However, if the user is currently
logged into a limited account, the remote hacker will only
gain privileges that are available to that user.
Windows WMF Vulnerability
A Windows Metafile (WMF) image is a 16-bit metafile format
that contains vector information as well as bitmap information.
A hacker could exploit this vulnerability by creating a
specially crafted WMF and embedding it into a website. A
hacker could also exploit this vulnerability by attaching
the WMF to an email message. Upon viewing the malicious
website, or viewing the attached file, a hacker could remotely
execute malicious code on the system.
Platforms and Operating Systems Affected
Microsoft Windows XP Tablet PC Edition SP2
Microsoft Windows XP Tablet PC Edition SP1
Microsoft Windows XP Tablet PC Edition
Microsoft Windows XP Professional x64 Edition
Microsoft Windows XP Professional SP2
Microsoft Windows XP Professional SP1
Microsoft Windows XP Professional
Microsoft Windows XP Media Center Edition SP2
Microsoft Windows XP Media Center Edition SP1
Microsoft Windows XP Media Center Edition
Microsoft Windows XP Home SP2
Microsoft Windows XP Home SP1
Microsoft Windows XP Home
Microsoft Windows Server 2003 Web Edition SP1
Microsoft Windows Server 2003 Web Edition
Microsoft Windows Server 2003 Standard x64 Edition
Microsoft Windows Server 2003 Standard Edition SP1
Microsoft Windows Server 2003 Standard Edition
Microsoft Windows Server 2003 Enterprise x64 Edition
Microsoft Windows Server 2003 Enterprise Edition 64-bit
SP1
Microsoft Windows Server 2003 Enterprise Edition 64-bit
Microsoft Windows Server 2003 Enterprise Edition SP1
Microsoft Windows Server 2003 Enterprise Edition
Microsoft Windows Server 2003 Datacenter x64 Edition
Microsoft Windows Server 2003 Datacenter Edition 64-bit
SP1
Microsoft Windows Server 2003 Datacenter Edition 64-bit
Microsoft Windows Server 2003 Datacenter Edition SP1
Microsoft Windows Server 2003 Datacenter Edition
Microsoft Windows ME
Microsoft Windows 98SE
Microsoft Windows 98
Microsoft Windows 2000 Server SP4
Microsoft Windows 2000 Server SP3
Microsoft Windows 2000 Server SP2
Microsoft Windows 2000 Server SP1
Microsoft Windows 2000 Server
Microsoft Windows 2000 Professional SP4
Microsoft Windows 2000 Professional SP3
Microsoft Windows 2000 Professional SP2
Microsoft Windows 2000 Professional SP1
Microsoft Windows 2000 Professional
Microsoft Windows 2000 Datacenter Server SP4
Microsoft Windows 2000 Datacenter Server SP3
Microsoft Windows 2000 Datacenter Server SP2
Microsoft Windows 2000 Datacenter Server SP1
Microsoft Windows 2000 Datacenter Server
Microsoft Windows 2000 Advanced Server SP4
Microsoft Windows 2000 Advanced Server SP3
Microsoft Windows 2000 Advanced Server SP2
Microsoft Windows 2000 Advanced Server SP1
Microsoft Windows 2000 Advanced Server
Avaya DefinityOne Media Servers
Avaya IP600 Media Servers
Avaya S3400 Message Application Server
Avaya S8100 Media Servers
Components Affected
XnView XnView Standard 1.80.3
XnView XnView Minimal 1.80.3
XnView XnView Complete 1.80.3
Wine Windows API Emulator 0.9.4
Wine Windows API Emulator 0.9.3
Wine Windows API Emulator 0.9.2
Wine Windows API Emulator 0.9.1
Wine Windows API Emulator 0.9
Avaya DefinityOne Media Servers R9
Avaya DefinityOne Media Servers R8
Avaya DefinityOne Media Servers R7
Avaya DefinityOne Media Servers R6
Avaya DefinityOne Media Servers R12
Avaya DefinityOne Media Servers R11
Avaya DefinityOne Media Servers R10
Avaya DefinityOne Media Servers
Avaya IP600 Media Servers R9
Avaya IP600 Media Servers R8
Avaya IP600 Media Servers R7
Avaya IP600 Media Servers R6
Avaya IP600 Media Servers R12
Avaya IP600 Media Servers R11
Avaya IP600 Media Servers R10
Avaya IP600 Media Servers
Avaya S3400 Message Application Server
Avaya S8100 Media Servers
IrfanView IrfanView 3.98
IrfanView IrfanView 3.97
IrfanView IrfanView 3.95
IBM Lotus Notes 6.5.4
IBM Lotus Notes 6.5.3
IBM Lotus Notes 6.5.2
IBM Lotus Notes 6.5.1
IBM Lotus Notes 6.5
Further Reading
Credits
The individual who discovered this exploit
is currently not known.
|
