POP3: .WMF

This signature detects Metafiles files sent over POP3. Windows Metafiles and Enhanced Metafiles files can take advantage of Windows GDI vulnerabilities. Attackers can exploit these vulnerabilities by depositing instructions or arbitrary code on a target's system. User involvement is required to activate Metafiles; typically they are attached to a harmless-appearing e-mail message.

Extended Description

Microsoft Windows WMF/EMF image-rendering library is affected by a remote buffer-overflow vulnerability because it fails to properly verify the lengths of strings contained within an affected image file before copying them into finite buffers. Any code execution that occurs will take place with SYSTEM privileges because of the nature of the affected library. This will also permit local privilege-escalation attacks.

Affected Products

Avaya s8100_media_servers,Microsoft windows_xp_media_center_edition

References

BugTraq: 11375

CVE: CVE-2004-0209

URL: http://www.internetfixes.com/file_ext.htm http://www.microsoft.com/technet/security/bulletin/MS04-032.mspx http://www.microsoft.com/technet/security/bulletin/MS06-004.mspx

Short Name

POP3:EXT:DOT-WMF

Severity

Minor

Recommended

False

Recommended Action

None

POP3: .WMF

Extended Description

Affected Products

References

Found a potential security threat?