PT-2005-5230 · Microsoft · Windows

Dan Hubbard · Published 2005-12-28 · Updated 2023-12-12 · CVE-2005-4560

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Windows (affected versions not specified)

Description A remote code execution issue exists in the Graphics Rendering Engine due to its handling of Windows Metafile (WMF) images. An attacker could exploit this by creating a specially crafted WMF image, potentially allowing remote code execution if a user visits a malicious website or opens a specially crafted email attachment. Successful exploitation could give an attacker complete control of the affected system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2005-4560

Affected Products

Windows

References · 64

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms06_001_wmf_setabortproc.rb · Exploit
• 🔥 http://securitytracker.com/id?1015416 · Exploit
• 🔥 http://securityfocus.com/bid/16074 · Exploit
• 🔥 https://exploit-db.com/exploits/16612 · Exploit
• 🔥 http://f-secure.com/weblog/archives/archive-122005.html#00000753 · Exploit
• http://vupen.com/english/advisories/2005/3086 · Vendor Advisory
• http://secunia.com/advisories/18364 · Vendor Advisory
• http://support.avaya.com/elmodocs2/security/ASA-2006-001.htm · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4560 · Security Note
• http://secunia.com/advisories/18311 · Vendor Advisory
• http://vil.mcafeesecurity.com/vil/content/v_137760.htm · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-4560 · Security Note
• http://microsoft.com/technet/security/advisory/912840.mspx · Vendor Advisory
• http://secunia.com/advisories/18255 · Vendor Advisory