Zero-day vulnerability in Windows
Buffer overflow
CVE-2007-0038
This vulnerability was discovered by Alexander Sotirov of Determina and was rediscovered in the wild by McAfee.
Vulnerability details
Advisory: SB2007033105 - Remote code execution in Microsoft Windows
Vulnerable component: Windows
CVE-ID: CVE-2007-0038
CVSSv3 score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H/E:F/RL:O/RC:C
CWE-ID: CWE-119 - Memory corruption
Description:
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to boundary error when handling cursor, animated cursor, and icon formats. A remote attacker can create a specially crafted malicious cursor or icon file, cause buffer overflow and execute arbitrary code on vulnerable system.
Successful exploitation of the vulnerability results in compromise of vulnerable system.
Note: this vulnerability is being actively exploited.
Public Exploits:
- Microsoft Windows - Animated Cursor '.ani' Remote Exploit (eeye patch Bypass) [Exploit-DB]
- Microsoft Windows - Animated Cursor '.ani' Local Buffer Overflow [Exploit-DB]
- Microsoft Windows - ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (SMTP) (MS07-017) (Metasploit) [Exploit-DB]
- Microsoft Windows - Animated Cursor '.ani' Stack Overflow [Exploit-DB]
- Microsoft Windows XP/Vista - Animated Cursor '.ani' Remote Overflow [Exploit-DB]
- Microsoft Windows - Animated Cursor Stack Overflow [Exploit-DB]
- Microsoft Windows XP - Animated Cursor '.ani' Remote Overflow (2) [Exploit-DB]
- Microsoft Windows - GDI Privilege Escalation (MS07-017) (1) [Exploit-DB]
- Microsoft Windows - '.ani' GDI Remote Elevation of Privilege Exploit (MS07-017) [Exploit-DB]
- Microsoft Windows - Animated Cursor '.ani' Local Overflow [Exploit-DB]
- Microsoft Windows - GDI Privilege Escalation (MS07-017) (2) [Exploit-DB]
- Microsoft Windows - Animated Cursor '.ani' Overflow (Hardware DEP) [Exploit-DB]
- Microsoft Windows - ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (HTTP) (MS07-017) (Metasploit) [Exploit-DB]
- Microsoft Windows - Animated Cursor '.ani' Universal Exploit Generator [Exploit-DB]
- Microsoft Windows - Explorer Unspecified .ANI File Denial of Service [Exploit-DB]
External links:
http://www.priveon.com/dmdocuments/PV-A-070003A.pdf
http://www.securityfocus.com/archive/1/464339/100/0/threaded
https://isc.sans.edu/diary/Windows+Animated+Cursor+Handling+vulnerability+-+CVE-2007-0038/2534
https://technet.microsoft.com/library/security/935423
https://technet.microsoft.com/en-us/library/security/ms07-017.aspx