HTTP: Metafile Extension Request

This signature detects metafiles (files with .emf or .wmf extensions) in a Web page. Some versions of Microsoft Windows produce boundary errors when processing metafiles, enabling attackers to create a denial of service (DoS) and execute arbitrary code.

Extended Description

It has been reported that Windows may be prone to a remote buffer overflow vulnerability when rendering WMF/EMF image files. An attacker could create a malicious WMF or EMF file and entice a user to view the file via an application that supports the WMF and EMF formats. Immediate consequences of this attack may result in a denial of service condition, however, it is possible that an attacker could leverage this issue to execute arbitrary code in the context of the vulnerable user. This issue may be similar to the vulnerabilities described in BID 9892 (Microsoft Windows XP explorer.exe Remote Denial of Service Vulnerability) and BID 9707 (Microsoft Windows XP explorer.exe Multiple Memory Corruption Vulnerabilities).

Affected Products

Avaya s8100_media_servers,Microsoft windows_xp_tablet_pc_edition

References

BugTraq: 10120

CVE: CVE-2003-0906

URL: http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

Short Name

HTTP:EXT:METAFILE

Severity

Warning

Recommended

False

Recommended Action

None

HTTP: Metafile Extension Request

Extended Description

Affected Products

References

Found a potential security threat?