HTTP: WMF File Download

This signature detects Windows MetaFile (WMF) images being downloaded through HTTP. Malformed WMF files can trigger a known vulnerability in several Windows versions. WMF files are generally not sent over the Internet aside from publishing industries. Networks that routinely transfer WMF files should consider not including this signature in a security policy

Extended Description

Microsoft Windows WMF graphics rendering engine is affected by a remote code execution vulnerability. The problem presents itself when a user views a malicious WMF formatted file, triggering the vulnerability when the engine attempts to parse the file. A malicious file can cause an integer overflow that may facilitate heap memory corruption and arbitrary code execution. Any code execution that occurs will be with SYSTEM privileges due to the nature of the affected engine. Successful exploitation can facilitate a remote compromise or local privilege escalation.

Affected Products

Avaya s8100_media_servers,Microsoft windows_xp_media_center_edition

References

BugTraq: 15356

CVE: CVE-2005-2124

Short Name

HTTP:STC:IMG:WMF-DOWNLOAD

Severity

Warning

Recommended

False

Recommended Action

None

HTTP: WMF File Download

Extended Description

Affected Products

References

Found a potential security threat?