PT-2005-3060 · Microsoft · Windows Server 2003+2

Published 2005-11-29 · Updated 2018-10-12 · CVE-2005-2123

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Windows 2000 SP4 Windows XP SP1 Windows XP SP2 Windows Server 2003 SP1

Description: The issue is related to multiple integer overflows in the Graphics Rendering Engine (GDI32.DLL) that allow remote attackers to execute arbitrary code. This is achieved through crafted Windows Metafile (WMF) and Enhanced Metafile (EMF) format images, leading to heap-based buffer overflows. The exploitation can be demonstrated using MRBP16::bCheckRecord.

Recommendations: For Windows 2000 SP4, update to a newer version to mitigate the risk. For Windows XP SP1, update to a newer version to mitigate the risk. For Windows XP SP2, update to a newer version to mitigate the risk. For Windows Server 2003 SP1, update to a newer version to mitigate the risk.

Exploit

Fix

Related Identifiers

CVE-2005-2123

Affected Products

Windows 2000

Windows Server 2003

Windows Xp

References · 18

• 🔥 https://exploit-db.com/exploits/1346 · Exploit
• http://kb.cert.org/vuls/id/300549 · Patch
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-053 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-2123 · Security Note
• http://eeye.com/html/research/advisories/AD20051108b.html · Vendor Advisory
• http://support.avaya.com/elmodocs2/security/ASA-2005-228.pdf · Note
• http://secunia.com/advisories/17498 · Note
• http://secunia.com/advisories/17223 · Note
• http://securitytracker.com/id?1015168 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A701 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1063 · Note
• http://vupen.com/english/advisories/2005/2348 · Note
• http://securityfocus.com/bid/15352 · Note
• http://secunia.com/advisories/17461 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1546 · Note