PT-2007-6237 · Microsoft · Windows Live Messenger

Lostmon · Published 2007-10-01 · Updated 2008-11-15 · CVE-2007-5144

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Windows Live Messenger version 8.1

Description The issue is related to a buffer overflow in the GDI engine, which can be triggered by placing a malformed file in a new folder under the Sharing Folders path and then synchronizing through the Windows MSN Live online service. This can cause a denial of service, resulting in an application or system crash, and potentially allow the execution of arbitrary code. The malformed file can be in various formats, including .jpg, .gif, .wmf, .doc, or .ico.

Recommendations For Windows Live Messenger version 8.1, consider avoiding the use of the synchronize operation through the Windows MSN Live online service until a fix is available. As a temporary workaround, restrict access to the Sharing Folders path to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2007-5144

Affected Products

Windows Live Messenger

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2007-5144 · Security Note
• http://lostmon.blogspot.com/2007/09/windows-live-messenger-jpg-overflow.html · Note
• http://osvdb.org/45523 · Note
• http://securityfocus.com/bid/25795 · Note