Microsoft Windows XP/Server 2003 WMF File Handler Designfehler

VulDB: Microsoft Windows XP/Server 2003 WMF File Handler Designfehler

General

Microsoft

scipID: 1934
Affected: Microsoft Windows XP/Server 2003
Published: 12/28/2005 (Dan Hubbard)
Risk: very critical
Entry: 100% complete
Created: 12/28/2005
Updated: 04/09/2013

Summary

A vulnerability, which was classified as very critical, has been found in Microsoft Windows XP/Server 2003. Affected by this issue is an unknown function of the component WMF File Handler. The manipulation with an unknown input leads to a designfehler vulnerability. The impact remains unknown.

The weakness was shared 12/28/2005 by Dan Hubbard with Websense Security Labs as MS06-001. The advisory is shared for download at microsoft.com. This vulnerability is handled as CVE-2005-4560 since 12/28/2005. The attack may be launched remotely. The technical details are unknown and an exploit is not available.

The vulnerability was handled as a non-public zero-day exploit for at least 8 days. The vulnerability scanner Nessus provides a plugin with the ID 20382, which helps to determine the existence of the flaw in a target environment. It is running in the context local and relying on port 139.

Applying the patch MS06-001 is able to eliminate this problem. The bugfix is ready for download at microsoft.com. A possible mitigation has been published 2 weeks after the disclosure of the vulnerability. The vulnerability is also documented in the databases at OSVDB (21987), Secunia (SA18415), SecurityFocus (BID 16074), SecurityTracker (ID 1015416) and X-Force (23846). scip.ch is providing further details.