CVE-2005-4560 The Windows Graphical Device Interface library (GDI32.DLL) in Microsoft Windows allows remote attackers to execute arbitrary code via a Windows Metafile (WMF) format image with a crafted SETABORTPROC....
HighCVSS 7.5
EPSS 86.1%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The Windows Graphical Device Interface library (GDI32.DLL) in Microsoft Windows allows remote attackers to execute arbitrary code via a Windows Metafile (WMF) format image with a crafted SETABORTPROC GDI Escape function call, related to the Windows Picture and Fax Viewer (SHIMGVW.DLL), a different vulnerability than CVE-2005-2123 and CVE-2005-2124, and as originally discovered in the wild on unionseek.com.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft windows 2003 server | = enterprise | No fix listed |
| Microsoft windows 2003 server | = enterprise-sp1 | No fix listed |
| Microsoft windows 2003 server | = r2 | No fix listed |
| Microsoft windows 2003 server | = r2-sp1 | No fix listed |
| Microsoft windows 2003 server | = standard | No fix listed |
| Microsoft windows 2003 server | = standard-sp1 | No fix listed |
| Microsoft windows 2003 server | = web | No fix listed |
| Microsoft windows 2003 server | = web-sp1 | No fix listed |
| Microsoft windows xp | All versions | No fix listed |
References
- linuxbox.org
- 18255 third-party-advisory vendor-advisory
- 18311 third-party-advisory vendor-advisory
- 18364 third-party-advisory vendor-advisory
- 18415 third-party-advisory vendor-advisory
- 1015416 exploit vdb-entry
- support.avaya.com vendor-advisory
- vil.mcafeesecurity.com vendor-advisory
- www.f-secure.com exploit vendor-advisory
- VU#181038 third-party-advisory us-government-resource
- www.microsoft.com vendor-advisory
- 20051227 Is this a new exploit? mailing-list
- 20051227 Exploitation of Windows WMF on the web mailing-list
- 20051228 RE: [Full-disclosure] Someone wasted a nice bug on spyware... mailing-list
- 20051228 Re: Is this a new exploit? mailing-list
- 20051228 WMF Exploit mailing-list
- 20051229 WMF exploit mailing-list
- 20051229 RE: WMF Exploit mailing-list
- 20060101 Re: RE: WMF Exploit mailing-list
- 20060103 WMF round-up, updates and de-mystification mailing-list
- 20060103 WMF SETABORTPROC exploit mailing-list
- 20060103 Re: [funsec] WMF round-up, updates and de-mystification mailing-list
- 20060104 Another WMF exploit workaround mailing-list
- 16074 exploit vdb-entry
- TA05-362A third-party-advisory us-government-resource
- TA06-005A third-party-advisory us-government-resource
- ADV-2005-3086 vdb-entry vendor-advisory
- www130.nortelnetworks.com
- www130.nortelnetworks.com
- MS06-001 vendor-advisory
- win-wmf-execute-code(23846) vdb-entry
- oval:org.mitre.oval:def:1431 signature vdb-entry
- oval:org.mitre.oval:def:1433 signature vdb-entry
- oval:org.mitre.oval:def:1460 signature vdb-entry
- oval:org.mitre.oval:def:1492 signature vdb-entry
- oval:org.mitre.oval:def:1564 signature vdb-entry
- oval:org.mitre.oval:def:1612 signature vdb-entry