PT-2007-6237 · Microsoft · Windows Live Messenger

Lostmon · Publicado 2007-10-01 · Atualizado 2008-11-15 · CVE-2007-5144

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Windows Live Messenger version 8.1

Description The issue is related to a buffer overflow in the GDI engine, which can be triggered by placing a malformed file in a new folder under the Sharing Folders path and then synchronizing through the Windows MSN Live online service. This can cause a denial of service, resulting in an application or system crash, and potentially allow the execution of arbitrary code. The malformed file can be in various formats, including .jpg, .gif, .wmf, .doc, or .ico.

Recommendations For Windows Live Messenger version 8.1, consider avoiding the use of the synchronize operation through the Windows MSN Live online service until a fix is available. As a temporary workaround, restrict access to the Sharing Folders path to minimize the risk of exploitation.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2007-5144

Produtos afetados

Windows Live Messenger

Referências · 4

• http://lostmon.blogspot.com/2007/09/windows-live-messenger-jpg-overflow.html · Nota
• http://osvdb.org/45523 · Nota
• http://securityfocus.com/bid/25795 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5144 · Nota de Segurança