National Vulnerability Database (NVD) National Vulnerability Database (CVE-2005-4560)

National Cyber Awareness System

Vulnerability Summary for CVE-2005-4560

Original release date:12/28/2005

Last revised:09/22/2011

Source: US-CERT/NIST

Overview

The Windows Graphical Device Interface library (GDI32.DLL) in Microsoft Windows allows remote attackers to execute arbitrary code via a Windows Metafile (WMF) format image with a crafted SETABORTPROC GDI Escape function call, related to the Windows Picture and Fax Viewer (SHIMGVW.DLL), a different vulnerability than CVE-2005-2123 and CVE-2005-2124, and as originally discovered in the wild on unionseek.com.

Impact

CVSS Severity (version 2.0):

CVSS v2 Base Score:7.5 (HIGH) (AV:N/AC:L/Au:N/C:P/I:P/A:P) (legend)

Impact Subscore: 6.4

Exploitability Subscore: 10.0

CVSS Version 2 Metrics:

Access Vector: Network exploitable

Access Complexity: Low

Authentication: Not required to exploit

Impact Type:Provides user account access, Allows partial confidentiality, integrity, and availability violation; Allows unauthorized disclosure of information; Allows disruption of service

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Technical Alert: TA06-005A

Name: TA06-005A

Type: Advisory

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA06-005A.html

US-CERT Technical Alert: TA05-362A

Name: TA05-362A

Type: Advisory

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA05-362A.html

US-CERT Vulnerability Note: VU#181038

Name: VU#181038

Type: Advisory

Hyperlink:http://www.kb.cert.org/vuls/id/181038

External Source: MS

Name: MS06-001

Type: Patch Information

Hyperlink:http://www.microsoft.com/technet/security/bulletin/ms06-001.mspx

External Source: XF

Name: win-wmf-execute-code(23846)

Hyperlink:http://xforce.iss.net/xforce/xfdb/23846

External Source: MISC

Name: http://www130.nortelnetworks.com/cgi-bin/eserv/cs/main.jsp?cscat=BLTNDETAIL&DocumentOID=375420

Hyperlink:http://www130.nortelnetworks.com/cgi-bin/eserv/cs/main.jsp?cscat=BLTNDETAIL&DocumentOID=375420

External Source: MISC

Name: http://www130.nortelnetworks.com/cgi-bin/eserv/cs/main.jsp?cscat=BLTNDETAIL&DocumentOID=375341

Hyperlink:http://www130.nortelnetworks.com/cgi-bin/eserv/cs/main.jsp?cscat=BLTNDETAIL&DocumentOID=375341

External Source: VUPEN

Name: ADV-2005-3086

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2005/3086

External Source: BID

Name: 16074

Hyperlink:http://www.securityfocus.com/bid/16074

External Source: BUGTRAQ

Name: 20060104 Another WMF exploit workaround

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/420773/100/0/threaded

External Source: BUGTRAQ

Name: 20060103 Re: [funsec] WMF round-up, updates and de-mystification

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/420687/100/0/threaded

External Source: BUGTRAQ

Name: 20060103 WMF SETABORTPROC exploit

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/420684/100/0/threaded

External Source: BUGTRAQ

Name: 20060103 WMF round-up, updates and de-mystification

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/420682/100/0/threaded

External Source: BUGTRAQ

Name: 20060101 Re: RE: WMF Exploit

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/420664/30/7730/threaded

External Source: BUGTRAQ

Name: 20051229 RE: WMF Exploit

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/420546/30/7730/threaded

External Source: BUGTRAQ

Name: 20051229 WMF exploit

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/420446/100/0/threaded

External Source: BUGTRAQ

Name: 20051228 WMF Exploit

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/420378/100/0/threaded

External Source: BUGTRAQ

Name: 20051228 Re: Is this a new exploit?

Type: Advisory; Exploit

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/420367/100/0/threaded

External Source: BUGTRAQ

Name: 20051228 RE: [Full-disclosure] Someone wasted a nice bug on spyware...

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/420357/100/0/threaded

External Source: BUGTRAQ

Name: 20051227 Exploitation of Windows WMF on the web

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/420351/100/0/threaded

External Source: BUGTRAQ

Name: 20051227 Is this a new exploit?

Type: Advisory; Exploit

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/420288/100/0/threaded

External Source: MISC

Name: http://www.microsoft.com/technet/security/advisory/912840.mspx

Type: Advisory

Hyperlink:http://www.microsoft.com/technet/security/advisory/912840.mspx

External Source: MISC

Name: http://www.f-secure.com/weblog/archives/archive-122005.html#00000753

Type: Advisory; Exploit

Hyperlink:http://www.f-secure.com/weblog/archives/archive-122005.html#00000753

External Source: MISC

Name: http://vil.mcafeesecurity.com/vil/content/v_137760.htm

Type: Advisory

Hyperlink:http://vil.mcafeesecurity.com/vil/content/v_137760.htm

External Source: MISC

Name: http://support.avaya.com/elmodocs2/security/ASA-2006-001.htm

Type: Advisory

Hyperlink:http://support.avaya.com/elmodocs2/security/ASA-2006-001.htm

External Source: SECTRACK

Name: 1015416

Hyperlink:http://securitytracker.com/id?1015416

External Source: SECUNIA

Name: 18415

Type: Advisory

Hyperlink:http://secunia.com/advisories/18415

External Source: SECUNIA

Name: 18364

Type: Advisory

Hyperlink:http://secunia.com/advisories/18364

External Source: SECUNIA

Name: 18311

Type: Advisory

Hyperlink:http://secunia.com/advisories/18311

External Source: SECUNIA

Name: 18255

Type: Advisory

Hyperlink:http://secunia.com/advisories/18255

External Source: MISC

Name: http://linuxbox.org/pipermail/funsec/2006-January/002455.html

Hyperlink:http://linuxbox.org/pipermail/funsec/2006-January/002455.html

US Government Resource: oval:org.mitre.oval:def:1612

Name: oval:org.mitre.oval:def:1612

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1612

US Government Resource: oval:org.mitre.oval:def:1564

Name: oval:org.mitre.oval:def:1564

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1564

US Government Resource: oval:org.mitre.oval:def:1492

Name: oval:org.mitre.oval:def:1492

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1492

US Government Resource: oval:org.mitre.oval:def:1460

Name: oval:org.mitre.oval:def:1460

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1460

US Government Resource: oval:org.mitre.oval:def:1433

Name: oval:org.mitre.oval:def:1433

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1433

US Government Resource: oval:org.mitre.oval:def:1431

Name: oval:org.mitre.oval:def:1431

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1431