SMTP: DOT WMF

This signature detects metafiles (files with .emf or .wmf extensions) in an email attachment. Some versions of Microsoft Windows produce boundary errors when processing metafiles, enabling attackers to create a denial of service (DoS) and execute arbitrary code.

Extended Description

It has been reported that Windows may be prone to a remote buffer overflow vulnerability when rendering WMF/EMF image files. An attacker could create a malicious WMF or EMF file and entice a user to view the file via an application that supports the WMF and EMF formats. Immediate consequences of this attack may result in a denial of service condition, however, it is possible that an attacker could leverage this issue to execute arbitrary code in the context of the vulnerable user. This issue may be similar to the vulnerabilities described in BID 9892 (Microsoft Windows XP explorer.exe Remote Denial of Service Vulnerability) and BID 9707 (Microsoft Windows XP explorer.exe Multiple Memory Corruption Vulnerabilities).

Affected Products

Avaya s8100_media_servers,Microsoft windows_xp_tablet_pc_edition

References

BugTraq: 10120

CVE: CVE-2003-0906

URL: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0209

Short Name

SMTP:EXT:DOT-WMF

Severity

Info

Recommended

False

Recommended Action

None

SMTP: DOT WMF

Extended Description

Affected Products

References

Found a potential security threat?