SMTP: WMF Malformed File

This signature detects malformed Windows MetaFile (WMF) images in an e-mail attachment. Malformed WMF files can trigger a known vulnerability in several Windows versions. WMF files are generally not sent over the Internet except from publishing industries.

Extended Description

It has been reported that Windows may be prone to a remote buffer overflow vulnerability when rendering WMF/EMF image files. An attacker could create a malicious WMF or EMF file and entice a user to view the file via an application that supports the WMF and EMF formats. Immediate consequences of this attack may result in a denial of service condition, however, it is possible that an attacker could leverage this issue to execute arbitrary code in the context of the vulnerable user. This issue may be similar to the vulnerabilities described in BID 9892 (Microsoft Windows XP explorer.exe Remote Denial of Service Vulnerability) and BID 9707 (Microsoft Windows XP explorer.exe Multiple Memory Corruption Vulnerabilities).

Affected Products

Avaya s8100_media_servers,Microsoft windows_xp_tablet_pc_edition

References

BugTraq: 10120

CVE: CVE-2003-0906

URL: http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0209

Short Name

SMTP:MAL:MALFORMED-WMF

Severity

Major

Recommended

False

Recommended Action

None

SMTP: WMF Malformed File

Extended Description

Affected Products

References

Found a potential security threat?