{"vuid":"VU#433341","idnumber":"433341","name":"Microsoft Windows vulnerable to buffer overflow via specially crafted WMF file","keywords":["Microsoft","Windows","buffer overflow","BoF","WMF file","MS05-053"],"overview":"Microsoft Windows may be vulnerable to remote code execution via a buffer overflow in the Windows Metafile image format handling.","clean_desc":"Windows Metafile (WMF) format images are metafiles that can contain both vector and bitmap-based information. Microsoft Windows contains routines for displaying WMF files. However, a lack of input validation in on of these routines may allow a buffer overflow to occur, and in turn may allow remote arbitrary code execution.","impact":"A remote, unauthenticated attacker may be able to execute arbitrary code if the user is persuaded to view a specially crafted WMF file.","resolution":"Apply an update\nPlease see Microsoft Security Bulletin MS05-053 for details on updates, workarounds, and solutions.","workarounds":"Do not access WMF files from untrusted sources Exploitation occurs by accessing a specially crafted WMF file (typically .wmf). By only accessing WMF files from trusted or known sources, the chances of exploitation are reduced. Attackers may host malicious WMF files on a web site. In order to convince users to visit their sites, those attackers often use URL encoding, IP address variations, long URLs, intentional misspellings, and other techniques to create misleading links. Do not click on unsolicited links received in email, instant messages, web forums, or internet relay chat (IRC) channels. Type URLs directly into the browser to avoid these misleading links. While these are generally good security practices, following these behaviors will not prevent exploitation of this vulnerability in all cases, particularly if a trusted site has been compromised or allows cross-site scripting.","sysaffected":"","thanks":"Thanks to Microsoft for reporting this vulnerability, who in turn thank \nVenustech AdDLab eEye Digital Security\n and Peter Ferrie of \nSymantec Security Response for information on the issue.","author":"This document was written by Ken MacInnis.","public":["http://www.microsoft.com/technet/security/Bulletin/MS05-053.mspx","http://www.eeye.com/html/research/advisories/AD20051108b.html"],"cveids":["CVE-2005-2124"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2005-11-08T18:56:28Z","publicdate":"2005-11-08T00:00:00Z","datefirstpublished":"2005-11-08T20:31:00Z","dateupdated":"2005-11-09T21:30:07Z","revision":11,"vrda_d1_directreport":"","vrda_d1_population":"","vrda_d1_impact":"","cam_widelyknown":"15","cam_exploitation":"0","cam_internetinfrastructure":"12","cam_population":"20","cam_impact":"18","cam_easeofexploitation":"3","cam_attackeraccessrequired":"20","cam_scorecurrent":"10.935","cam_scorecurrentwidelyknown":"12.96","cam_scorecurrentwidelyknownexploited":"21.06","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":10.935,"vulnote":null}