PT-2005-3060 · Microsoft · Windows Server 2003+2

Publicado

2005-11-29

·

Atualizado

2018-10-12

·

CVE-2005-2123

CVSS v2.0

7.5

Alta

VetorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions: Windows 2000 SP4 Windows XP SP1 Windows XP SP2 Windows Server 2003 SP1
Description: The issue is related to multiple integer overflows in the Graphics Rendering Engine (GDI32.DLL) that allow remote attackers to execute arbitrary code. This is achieved through crafted Windows Metafile (WMF) and Enhanced Metafile (EMF) format images, leading to heap-based buffer overflows. The exploitation can be demonstrated using MRBP16::bCheckRecord.
Recommendations: For Windows 2000 SP4, update to a newer version to mitigate the risk. For Windows XP SP1, update to a newer version to mitigate the risk. For Windows XP SP2, update to a newer version to mitigate the risk. For Windows Server 2003 SP1, update to a newer version to mitigate the risk.

Exploit

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2005-2123

Produtos afetados

Windows 2000
Windows Server 2003
Windows Xp