Microsoft Windows Address Book (WAB) File Format Parsing Vulnerability

2006-04-1100:00:00

Stuart Pearson - Computer Terrorism (UK)

www.zerodayinitiative.com

5.1 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

0.607 Medium

EPSS

Percentile

97.8%

JSON

This vulnerability allows attackers to execute arbitrary code on vulnerable installations of the Microsoft Windows operating system. User interaction is required to exploit this vulnerability. The specific flaw exists during the parsing of malformed Windows Address Book (.WAB) files. Modification of the length value of certain Unicode strings within this file format results in an exploitable heap corruption.