Vulnerability Name:

CVE-2005-2123 (CCN-22876)

Assigned:2005-11-08
Published:2005-11-08
Updated:2018-10-12
Summary:Multiple integer overflows in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allow remote attackers to execute arbitrary code via crafted Windows Metafile (WMF) and Enhanced Metafile (EMF) format images that lead to heap-based buffer overflows, as demonstrated using MRBP16::bCheckRecord.
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2005-2123

Source: CCN
Type: SA17223
Nortel Centrex IP Client Manager Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
17223

Source: CCN
Type: SA17461
Avaya Products Microsoft Windows WMF/EMF Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
17461

Source: CCN
Type: SA17498
Microsoft Windows WMF/EMF File Rendering Arbitrary Code Execution

Source: SECUNIA
Type: UNKNOWN
17498

Source: CCN
Type: SECTRACK ID: 1015168
Microsoft Windows Buffer Overflows in Graphics Rendering Engine Lets Remote Users Execute Arbitrary Code

Source: SECTRACK
Type: UNKNOWN
1015168

Source: CONFIRM
Type: UNKNOWN
http://support.avaya.com/elmodocs2/security/ASA-2005-228.pdf

Source: MISC
Type: Patch, Vendor Advisory
http://www.eeye.com/html/research/advisories/AD20051108b.html

Source: CCN
Type: US-CERT VU#300549
Microsoft Windows Graphics Rendering Engine buffer overflow vulnerability

Source: CERT-VN
Type: Patch, Third Party Advisory, US Government Resource
VU#300549

Source: CCN
Type: Microsoft Security Bulletin MS05-053
Vulnerabilities in Graphics Rendering Engine Could Allow Code Execution (896424)

Source: BID
Type: UNKNOWN
15352

Source: CCN
Type: BID-15352
Microsoft Windows Graphics Rendering Engine WMF/EMF Format Code Execution Vulnerability

Source: CERT
Type: US Government Resource
TA05-312A

Source: VUPEN
Type: UNKNOWN
ADV-2005-2348

Source: MS
Type: UNKNOWN
MS05-053

Source: XF
Type: UNKNOWN
win-wmf-emf-bo(22876)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:1063

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:1175

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:1263

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:1546

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:701

Vulnerable Configuration:Configuration 1:
  • cpe:/o:microsoft:windows_2000:*:sp4:*:fr:*:*:*:*
  • OR cpe:/o:microsoft:windows_2003_server:64-bit:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_2003_server:itanium:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_2003_server:r2:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_2003_server:sp1:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_2003_server:sp1:*:itanium:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:*:*:64-bit:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:*:sp1:tablet_pc:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:*:sp2:tablet_pc:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/o:microsoft:windows_xp:-:sp1:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_2000:-:sp4:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:2003_server::x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:xp:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_2003_server:-::~~~~itanium~:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:2003_server:sp1:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:2003_server:sp1_itanium:*:*:*:*:*:*
  • OR cpe:/a:microsoft:windows_2003:*:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:701
    V
    		WMF Rendering Code Execution Vulnerability (64-bit Windows XP and Server 2003,SP1)
    2011-05-16
    oval:org.mitre.oval:def:1546
    V
    		WMF Rendering Code Execution Vulnerability (32-bit Windows XP,SP1)
    2011-05-16
    oval:org.mitre.oval:def:1063
    V
    		WMF Rendering Code Execution Vulnerability (Windows 2000)
    2011-05-16
    oval:org.mitre.oval:def:1175
    V
    		WMF Rendering Code Execution Vulnerability (32-bit Windows XP,SP2)
    2011-05-16
    oval:org.mitre.oval:def:1263
    V
    		WMF Rendering Code Execution Vulnerability (64-bit Windows XP and Server 2003,Unpatched)
    2011-05-16
    BACK
    microsoft windows 2000 * sp4
    microsoft windows 2003 server 64-bit
    microsoft windows 2003 server itanium
    microsoft windows 2003 server r2
    microsoft windows 2003 server sp1
    microsoft windows 2003 server sp1
    microsoft windows xp *
    microsoft windows xp * sp1
    microsoft windows xp * sp2
    microsoft windows xp - sp1
    microsoft windows 2000 - sp4
    microsoft windows 2003_server
    microsoft windows xp sp2
    microsoft windows 2003 server -
    microsoft windows 2003_server sp1
    microsoft windows 2003_server sp1_itanium
    microsoft windows 2003 *