Code injection

gdi/driver.c and gdi/printdrv.c in Wine 20050930, and other versions, implement the SETABORTPROC GDI Escape function call for Windows Metafile WMF files, which allows attackers to execute arbitrary code, the same vulnerability as CVE-2005-4560 but in a different codebase...

CVE-2006-0106

gdi/driver.c and gdi/printdrv.c in Wine 20050930, and other versions, implement the SETABORTPROC GDI Escape function call for Windows Metafile WMF files, which allows attackers to execute arbitrary code, the same vulnerability as CVE-2005-4560 but in a different codebase...

20051228.ie_xp_pfv_metafile.pm

This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the core Framework dual GPLv2 and Artistic. The latest version of the...

ie_xp_pfv_metafile.pm.txt

This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the core Framework dual GPLv2 and Artistic. The latest version of the...

Windows WMF handling vulnerability

Added: 12/30/2005 CVE: CVE-2005-4560 BID: 16074 OSVDB: 21987 Background A Windows Metafile WMF image is a 16-bit metafile format that can contain both vector information and bitmap information. Problem A flaw in the way specially crafted WMF images are handled can allow arbitrary command executio...

US-CERT Technical Cyber Security Alert TA05-362A -- Microsoft Windows Metafile Handling Buffer Overflow

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Microsoft Windows Metafile Handling Buffer Overflow Original release date: December 28, 2005 Last revised: -- Source: US-CERT Systems Affected Systems running Microsoft Windows Overview Microsoft Windows is vulnerable to remote code execution via an...

PT-2005-5230 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: A remote code execution issue exists in the Graphics Rendering Engine due to its handling of Windows Metafile WMF images. An attacker could exploit this by creating a specially crafted WMF...

[Full-disclosure] Someone wasted a nice bug on spyware...

In reference to: http://www.securityfocus.com/archive/1/420288/30/0/threaded I ported the exploit to the Metasploit Framework in case anyone wants to test it without installing a thousand spyware apps... Available from 'msfupdate' for MSF users, or in the 2.5 snapshot:...

Microsoft Windows Metafile handler SETABORTPROC GDI Escape vulnerability

Overview Microsoft Windows is vulnerable to remote code execution via an error in handling files using the Windows Metafile image format. Exploit code has been publicly posted and used to successfully attack fully-patched Windows XP SP2 systems. However, other versions of the Windows operating...

Microsoft Windows XP2003 - Metafile Escape() Code Execution (Metasploit)

Microsoft Windows XP2003 - Metafile Escape Code Execution Metasploit This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the cor...

Microsoft Windows XP/2003 - Metafile Escape() Code Execution (Metasploit)

This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the core Framework dual GPLv2 and Artistic. The latest version of the...

ieDoS.pm.txt

/ Author: Winny Thomas Pune, INDIA The crafted metafile from this code when viewed in internet explorer raises the CPU utilization to 100%. The code was tested on Windows 2000 server SP4. The issue does not occur with the hotfix for GDI MS05-053 installed Disclaimer: This code is for...

MS Windows Metafile (mtNoObjects) Denial of Service Exploit (MS05-053)

Exploit for unknown platform in category dos / poc ====================================================================== MS Windows Metafile mtNoObjects Denial of Service Exploit MS05-053 ====================================================================== / Author: Winny Thomas Pune, INDIA Th...

Microsoft Windows Metafile - 'mtNoObjects' Denial of Service (MS05-053)

/ Author: Winny Thomas Pune, INDIA The crafted metafile WMF from this code when viewed in explorer crashes it. The issue is seen when the field 'mtNoObjects' in the Metafile header is set to 0x0000. The code was tested on Windows 2000 server SP4. The issue does not occur with the hotfix for GDI...

CVE-2005-2124

Unspecified vulnerability in the Graphics Rendering Engine GDI32.DLL in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1, related to "An unchecked buffer" and possibly buffer overflows, allows remote attackers to execute arbitrary code via a crafted Windows Metafile WMF format image, aka...

CVE-2005-2124

The CVE-2005-2124 entry concerns a vulnerability in the Windows Graphics Rendering Engine (GDI32.DLL) affecting Windows 2000 SP4, XP SP1/SP2, and Server 2003 SP1. The flaw stems from an unchecked buffer in WMF handling, enabling remote code execution via a crafted Windows Metafile image. Exploita...

Microsoft Windows Metafile - gdi32.dll Denial of Service (MS05-053)

Microsoft Windows Metafile - gdi32.dll Denial of Service MS05-053 / Author: Winny Thomas Pune, INDIA The crafted metafile from this code when viewed in internet explorer raises the CPU utilization to 100%. The code was tested on Windows 2000 server SP4. The issue does not occur with the hotfix fo...

MS Windows Metafile (gdi32.dll) Denial of Service Exploit (MS05-053)

Exploit for unknown platform in category dos / poc ==================================================================== MS Windows Metafile gdi32.dll Denial of Service Exploit MS05-053 ==================================================================== / Author: Winny Thomas Pune, INDIA The...

MS Windows Metafile (gdi32.dll) Denial of Service Exploit (MS05-053)

No description provided by source. / Author: Winny Thomas Pune, INDIA The crafted metafile from this code when viewed in internet explorer raises the CPU utilization to 100%. The code was tested on Windows 2000 server SP4. The issue does not occur with the hotfix for GDI MS05-053 installed...

Microsoft Windows Metafile - 'gdi32.dll' Denial of Service (MS05-053)

/ Author: Winny Thomas Pune, INDIA The crafted metafile from this code when viewed in internet explorer raises the CPU utilization to 100%. The code was tested on Windows 2000 server SP4. The issue does not occur with the hotfix for GDI MS05-053 installed Disclaimer: This code is for...