Microsoft Windows kernel vulnerable to denial-of-service condition via animated cursor (.ani) rate number

Overview

A vulnerability exists in the way the Microsoft Windows kernel processes animated cursor (.ani) files with a rate number set to zero. Exploitation of this vulnerability may allow a remote attacker to cause a denial-of-service condition.

Description

A vulnerability exists in the way the Microsoft Windows kernel processes .ani files. These files contain animated graphics for icons and cursors. According to public reports, if the Windows kernel is supplied a .ani file with a rate number set to zero, it doesn’t properly handle the .ani file. As a result, the kernel may crash or consume 100% of the system resources resulting in a denial-of-service condition.

.ani files are parsed when the containing folder is opened or it is used as a cursor. In addition, Internet Explorer can process .ani files in HTML documents, so web pages and HTML email messages can also trigger this vulnerability. Other web browsers or programs that render HTML may also act as attack vectors.

Note that it is reported that Windows XP SP2 is not affected by this issue.

---

Impact

If a remote attacker can persuade a user to access a specially crafted .ani file, the attacker may be able to crash that user’s system.

---

Solution

Apply Patch

Apply a patch as described in Microsoft Security Bulletin MS05-002. Please also note that Microsoft is actively deploying the patches for this vulnerability via Windows Update.

---

Vendor Information

697136

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Microsoft Corporation __ Unknown

Notified: January 07, 2005 Updated: January 11, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

<http://www.microsoft.com/technet/security/bulletin/ms05-002.mspx&gt;

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23697136 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.securityfocus.com/archive/1/385340&gt;
• <http://www.xfocus.net/flashsky/icoExp/index.html&gt;
• <http://secunia.com/advisories/13645/&gt;
• <http://www.microsoft.com/technet/security/bulletin/ms05-002.mspx&gt;

Acknowledgements

This vulnerability was publicly reported by Sylvain Bruyere.

This document was written by Jeff Gennari.

Other Information

CVE IDs:	CVE-2004-1305
Severity Metric:	28.35 Date Public: